Joomla! nBill Component "message" Cross-Site Scripting Vulnerability

SECUNIA ADVISORY ID:
SA49004

VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/49004/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=49004

RELEASE DATE:
2012-04-27
DESCRIPTION:
A vulnerability has been discovered in the nBill component for
Joomla!, which can be exploited by malicious people to conduct
cross-site scripting attacks.

Input passed via the "message" parameter to index.php (when "option"
is set to "com_nbill" and "task" is set to "generated-view") is not
properly sanitised before being returned to the user. This can be
exploited to execute arbitrary HTML and script code in a user's
browser session in context of an affected site.

The vulnerability is confirmed in version 2.3.2. Other versions may
also be affected.

SOLUTION:
Filter malicious characters and character sequences using a proxy.

PROVIDED AND/OR DISCOVERED BY:
Jakub Galczyk.