ZynbER has reported some vulnerabilities in Pro Chat Rooms, which can be exploited by malicious people to conduct cross-site scripting and script insertion attacks.

1) Input passed to the "gud" parameter in profiles/index.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in the context of an affected site.

2) Input passed to the "avatar" parameter in sendData.php (when "chat" is set to "1" and "room" is set to a valid chat room name) is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in the context of an affected site.

These vulnerabilities are reported in version 3.0.2. Other versions may also be affected.

Solution
Update to version 3.0.3.

Provided and/or discovered by
ZynbER

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://milw0rm.com/exploits/7409

Deep Links
Links available to Secunia VIM customers