A Cross Site Scripting vulnerability has been discovered in Cisco systems' site. The vulnerability would allow attackers to cause users to view 3rd-party malicious JavaScript or HTML code as if it were the legitimate content offered by Cisco.
If you put the following script in the search engine's search field and click on the search button, the script will be executed (on the client's side):
"<scr!pt%alert('cisco systems site XSS')</scr!pt>"
Or, alternatively:
"<img src%"http://www.host.com/image.gif">"
This URL will have the same effect, without the need for user intervention:
http://www.cisco.com/pcgi-bin/search/search.pl"<scr!pt>alert('cisco systems site XSS')</script>"
