https://www.exploit-db.com/exploits/21599
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200212-100

BadBluePersonalEdition1.7.3版本存在跨站脚本（XSS）漏洞。远程攻击者作为其他用户通过注入脚本到cleanSearchString()函数执行任意脚本。

source: http://www.securityfocus.com/bid/5179/info

BadBlue is a P2P file sharing application distributed by Working Resources. It is designed for use on Microsoft Windows operating systems. BadBlue is operated through a web interface, generated by an included web server running on the local system.

A variant to BID 5086 has been reported to exist. Reportedly, EXT.DLL has been re-designed to pass user input to the cleanSearchString function. Unfortunately, this function is implemented as client side javascript, and unsanitized input must be displayed on the client machine as it is passed to the cleanSearchString function.

Additionally, user supplied input is displayed as the hidden form value "a0" without being sanitized. 

"hi"'));alert("ZING!!!");document.write(cleanSearchString('a

"><script>alert("ZING!!!");</script><

来源:XF
名称:badblue-cleansearchstring-xss(9514)
链接:http://xforce.iss.net/xforce/xfdb/9514
来源:BID
名称:5179
链接:http://www.securityfocus.com/bid/5179