Aliaksandr Hartsuyeu has discovered a vulnerability in raSMP, which can be exploited by malicious people to conduct script insertion attacks.

Input passed in the "User-Agent" HTTP header isn't sanitised before being saved to the database. This can be exploited to execute arbitrary script code in an administrator's browser session in context of an affected website when the administrator views the site statistics.

The vulnerability has been confirmed in version 2.0.0. Prior versions may also be affected.

Solution
Update to version 2.0.1 or later.

Provided and/or discovered by
Aliaksandr Hartsuyeu, eVuln.

Changelog
Further details available in Customer Area

Original Advisory
http://evuln.com/vulns/13/summary.html

Deep Links
Links available in Customer Area