============================================= INTERNET SECURITY AUDITORS ALERT 2006-004 - Original release date: April 18, 2006 - Last revised: November 13, 2007 - Discovered by: Jesus Olmos Gonzalez - Severity: 1/5 ============================================= I. VULNERABILITY ------------------------- VTLS.web.gateway cgi is vulnerable to XSS II. BACKGROUND ------------------------- vtls.web.gateway cgi is a product from Visionary Technology in Library Solutions. VTLS Inc. is a leading global company that creates and provides visionary technology in library solutions. The company provide these solutions to a diverse customer base of more than 900 libraries in over 32 countries. III. DESCRIPTION ------------------------- VTLS is vulnerable to a cross site scripting attack, it is possible to execue html and javascript code in the browser of who cliks in a malicious crafted link. Here is a simple proof of concept that change html page as example. An attacker could intercept the keyboard, or make CSRF to submit a form of other page. IV. PROOF OF CONCEPT ------------------------- http://somevtlsweb.net/cgi-bin/vtls/vtls.web.gateway?authority=1&searcht ype=subject%22%3E%3Ch1%3E%3Cmarquee%3EXSS%20bug%3C/marquee%3E%3C/h1%3E%3 C!--&kind=ns&conf=080104+++++++ VI. SYSTEMS AFFECTED ------------------------- All with this solution up to 48.1.0 VII. SOLUTION ------------------------- Update to Version 48.1.1 VII. SOLUTION ------------------------- Update to Version 48.1.1 VIII. REFERENCES ------------------------- www.vtls.com IX. CREDITS ------------------------- This vulnerability has been discovered and reported by Jesus Olmos Gonzalez (jolmos (at) isecauditors (dot) com). X. REVISION HISTORY ------------------------- April 18, 2006: Initial release. November 13, 2007: Last revision. XI. DISCLOSURE TIMELINE ------------------------- February 27, 2006: The vulnerability discovered by Internet Security Auditors. April 18, 2006: Initial vendor notification sent. No response April 26, 2006: Second vendor notification sent. Ping pong responses. September 14, 2006: Third vendor notification sent. No response. December 01, 2006: Fourth vendor notification sent. No response. December 04, 2006: New patch coming. No schedule. January 02, 2007: Fifth vendor contact to ask for planning. No response. January 22, 2007: Sixth vendor contact to ask for planning. Scheduled. March 23, 2007: Seventh vendor contact to ask for planning. Re-Scheduled. May 22, 2007: Eigth vendor contact to ask for planning. Re-Scheduled. October 01, 2007: Nineth vendor contact to ask for planning. Patch will be published in October. November 09, 2007: Tenth. Version 48.1.1 has been approved for general release and published. November 13, 2007: Advisory Published. XII. LEGAL NOTICES ------------------------- The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Internet Security Auditors, S.L. accepts no responsibility for any damage caused by the use or misuse of this information.