------------------------------------------------------------
       - EXPL-A-2005-004 exploitlabs.com Advisory 033 -
------------------------------------------------------------
                         - E-Data -






OVERVIEW
========
E-Data 2.0 is a powerful e-mail directory and management application
that will enhance your web site by letting visitors add, change and
delete their personal information to a directory


AFFECTED PRODUCTS
=================
E-Data 2.0
http://www.adventia.com/


DETAILS
=======
E-Data has user supplied input fields in search and in the "add to
database" functions. By inputting a query keyword followed by XSS style
script, future users may search and find the keyword that contains the
malicious xss.
The XSS is of a persistant nature as it is stored in the applications
database.


SOLUTION
========
none
1st contact: March 16, 2005 ( no reply )



PROOF OF CONCEPT
================
The vendor has a demo site, PoC is in the database,
just goto the "demo url" and enter "qwerty" in search box
demo url: http://www.adventia.com/cgi-bin/dir.pl



CREDITS
=======
This vulnerability was discovered and researched by 
Donnie Werner of exploitlabs

Donnie Werner
Information Security Specialist
security@exploitlabs.com

-- 
Visit http://exploitlabs.com

- Vulnerability and Penetration Testing - Training - Security Research -