Some vulnerabilities have been reported in AdPeeps, which can be exploited by malicious people to conduct cross-site scripting and script insertion attacks.

1) Input passed to the "uid", "campaignid", "type", "accname", "e9", "from", "subject", "loginpass", and "idno" parameter in index.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

2) Input passed to e.g. the first name and last name and potentially other input fields when purchasing advertising packages is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in the context of an affected site when malicious data is viewed.

The vulnerabilities are reported in version 8.5d1. Other versions may also be affected.

Solution
Edit the source code to ensure that input is properly sanitised.

Provided and/or discovered by
Matt and "all of InterN0T"

Changelog
Further details available in Customer Area

Original Advisory
http://milw0rm.com/exploits/8818

Deep Links
Links available in Customer Area