|
Description
|
|
Multiple vulnerabilities have been reported in SmartJobBoard, which can be exploited by malicious users to conduct script insertion attacks and by malicious people to conduct cross-site scripting attacks.
1) Input passed via the "keywords[exact_phrase]" parameter to search-results-resumes/ is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
2) Input passed via the "Title", "Education[InstitutionName]", "Education[Major]" parameters to add-listing/, the "form" parameter to private-messages/send/, the "caption" to screening-questionnaires/add-questions/, the "Title", "JobDescription", and "JobRequirements" parameters to add-listing/Job/Postjob/ is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed.
The vulnerabilities are reported in version 3.4. Other versions may also be affected.
|
