Joomla! JVClouds3D Module "tagcloud" Cross-Site Scripting Vulnerability

SECUNIA ADVISORY ID:
SA38161

VERIFY ADVISORY:
http://secunia.com/advisories/38161/

DESCRIPTION:
MustLive has discovered a vulnerability in the JVClouds3D module for
Joomla!, which can be exploited by malicious people to conduct
cross-site scripting attacks.

Input passed via the "tagcloud" parameter to tagcloud.swf (when
"mode" is set to "tags") is not properly sanitised before being
returned to the user. This can be exploited to execute arbitrary HTML
and script code in a user's browser session in context of an affected
site.

The vulnerability is confirmed in version 1.0.9b. Other versions may
also be affected.

SOLUTION:
Filter malicious characters and character sequences using a proxy.

PROVIDED AND/OR DISCOVERED BY:
MustLive

ORIGINAL ADVISORY:
http://websecurity.com.ua/3839/