SECUNIA ADVISORY ID: SA49004 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/49004/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=49004 RELEASE DATE: 2012-04-27DESCRIPTION: A vulnerability has been discovered in the nBill component for Joomla!, which can be exploited by malicious people to conduct cross-site scripting attacks. Input passed via the "message" parameter to index.php (when "option" is set to "com_nbill" and "task" is set to "generated-view") is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. The vulnerability is confirmed in version 2.3.2. Other versions may also be affected. SOLUTION: Filter malicious characters and character sequences using a proxy. PROVIDED AND/OR DISCOVERED BY: Jakub Galczyk.