:r0t has reported a vulnerability in DirectAdmin, which can be exploited by malicious people to conduct cross-site scripting attacks.Input passed to the "domain" parameter in CMD_USER_STATS is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of an affected site.Successful exploitation requires that the target user has valid user credentials.The vulnerability is reported in version 1.30.1. Other versions may also be affected.Solution:Filter malicious characters and character sequences in a web proxy.Provided and/or discovered by:r0tOriginal Advisory:http://pridels-team.blogspot.com/2007/06/directadmin-xss-vuln.html

Original post by Pankaj