The host is installed with SQL Server 2000 Reporting Services Service or 2005 SP4 or 2008 SP2 or SP3 or 2008 R2 SP1 or 2012 and is prone to reflected XSS vulnerability. A flaw is present in the application, which fails to handle SQL Server Report Manager input parameters. Successful exploitation could allows an attacker to inject a client-side script into the user's instance of Internet Explorer.