Secunia

A vulnerability has been identified in Escapade, which can be exploited by malicious people to disclose path information or conduct Cross-Site Scripting attacks against other visitors.

The vulnerability is caused due to missing input validation. When a non-existent resource is requested by supplying arbitrary input to the "PAGE" parameter, Escapade returns an error page ("500 Internal server error") that discloses the full path to the "esp-pages/" directory.

Furthermore, since the requested resource is included in the error page without prior sanitation, it is possible to include arbitrary script code, which will be executed in a user's browser when viewed.

Example:
http://[victim]/cgi-bin/esp?PAGE=<script>alert(document.domain)</script>

Solution
Filter input in a HTTP proxy or firewall with URL filtering capabilities.
Further details available in Customer Area

Provided and/or discovered by
Bahaa Naamneh

Deep Links
Links available in Customer Area