Vulnonym.org

CVE-2008-1795 - Expectative Hotel

Description

Multiple cross-site scripting (XSS) vulnerabilities in Blackboard Academic Suite 7.x and earlier and possibly some 8.0 versions allow remote attackers to inject arbitrary web script or HTML via (1) the searchText parameter in a Course action to webapps/blackboard/execute/viewCatalog or (2) the data__announcements___pk1_pk2__subject parameter in an ADD action to bin/common/announcement.pl.

Reference

http://secskill.wordpress.com/2008/03/27/hacking-blackboard-academic-suite-2/ http://www.scribd.com/doc/2363025/Hacking-Blackboard-Academic-Suite http://www.securityfocus.com/bid/28455 http://www.securitytracker.com/id?1019710 http://secunia.com/advisories/29543 http://securityreason.com/securityalert/3810 https://exchange.xforce.ibmcloud.com/vulnerabilities/41478 http://www.securityfocus.com/archive/1/490096/100/0/threaded