Secunia

A vulnerability has been reported in Ideal BB, which can be exploited by malicious people to conduct Cross-Site Scripting attacks against visitors.

The vulnerability is caused due to missing input validation in "error.asp" and can be exploited by injecting arbitrary script code in the "msg" parameter. This can be executed in another user's browser session and may disclose sensitive information (eg. cookie-based authentication information) associated with the site running Ideal BB or inclusion of malicious content, which the user thinks is part of the real website.

Example:
http://[victim]/idealbb/error.asp?e=16&sessionID={xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}&msg=<script>alert(document.cookie)</script>

The vulnerability has been reported in version 1.4.9 beta. However, prior versions may also be affected.

Solution
A fix has been released, which can be downloaded by members at:
Further details available in Customer Area

Provided and/or discovered by
G00db0y (Zone-H)

Original Advisory
http://www.zone-h.org/en/advisories/read/id=2838/

Deep Links
Links available in Customer Area