Tried, Tested and Proven

Security Advisory 06 – 056 – The P-Synch Windows domain password reset web applications style parameter allows JavaScript injection

Vulnerability discovery and development:

This vulnerability was discovered during an application assessment. Further research was then carried out post assessment.The vendor has been notified.

Credit for Discovery:

Tim Brown of Portcullis Computer Security Ltd.

Affected Systems:

All known versions of P-Synch.


It is possible to pass a remote URL for a style sheet to the P-Synch Windows domain password reset web application within the style parameter, which will then be referenced in the web pages returned.


An attacker could use this to execute malicious code on visitors computers using the techniques outlined in Tim Brown’s paper Misunderstanding Javascript injection[1].


Exploit code is not required.


Copyright © Portcullis Computer Security Limited 2006, All rights reserved worldwide.
Permission is hereby granted for the electronic redistribution of this information.
It is not to be edited or altered in any way without the express written consent of Portcullis Computer Security Limited.


The information herein contained may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user’s risk. In no event shall the author/distributor (Portcullis Computer Security Limited) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.