Administrator browser script execution via unescaped parameter

Reflected XSS in WebDesignBy Musicbox 2.0.3 and earlier allows remote attackers to run script in an administrator's browser. The request-handling code returns an attacker-controlled parameter in an administrative page without sanitization or output escaping; public records do not identify the parameter or code locus. Exploitation requires a high-privilege user, such as an administrator, to open a crafted URL, after which script runs in that user's browser context and can read or alter data available to the session.