VTLS.web.gateway cgi is vulnerable to XSS

2007.11.16
Risk: Low
Local: No
Remote: Yes
CWE: CWE-79


CVSS Base Score: 4.3/10
Impact Subscore: 2.9/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: None
Integrity impact: Partial
Availability impact: None

============================================= INTERNET SECURITY AUDITORS ALERT 2006-004 - Original release date: April 18, 2006 - Last revised: November 13, 2007 - Discovered by: Jesus Olmos Gonzalez - Severity: 1/5 ============================================= I. VULNERABILITY ------------------------- VTLS.web.gateway cgi is vulnerable to XSS II. BACKGROUND ------------------------- vtls.web.gateway cgi is a product from Visionary Technology in Library Solutions. VTLS Inc. is a leading global company that creates and provides visionary technology in library solutions. The company provide these solutions to a diverse customer base of more than 900 libraries in over 32 countries. III. DESCRIPTION ------------------------- VTLS is vulnerable to a cross site scripting attack, it is possible to execue html and javascript code in the browser of who cliks in a malicious crafted link. Here is a simple proof of concept that change html page as example. An attacker could intercept the keyboard, or make CSRF to submit a form of other page. IV. PROOF OF CONCEPT ------------------------- http://somevtlsweb.net/cgi-bin/vtls/vtls.web.gateway?authority=1&searcht ype=subject%22%3E%3Ch1%3E%3Cmarquee%3EXSS%20bug%3C/marquee%3E%3C/h1%3E%3 C!--&kind=ns&conf=080104+++++++ VI. SYSTEMS AFFECTED ------------------------- All with this solution up to 48.1.0 VII. SOLUTION ------------------------- Update to Version 48.1.1 VII. SOLUTION ------------------------- Update to Version 48.1.1 VIII. REFERENCES ------------------------- www.vtls.com IX. CREDITS ------------------------- This vulnerability has been discovered and reported by Jesus Olmos Gonzalez (jolmos (at) isecauditors (dot) com). X. REVISION HISTORY ------------------------- April 18, 2006: Initial release. November 13, 2007: Last revision. XI. DISCLOSURE TIMELINE ------------------------- February 27, 2006: The vulnerability discovered by Internet Security Auditors. April 18, 2006: Initial vendor notification sent. No response April 26, 2006: Second vendor notification sent. Ping pong responses. September 14, 2006: Third vendor notification sent. No response. December 01, 2006: Fourth vendor notification sent. No response. December 04, 2006: New patch coming. No schedule. January 02, 2007: Fifth vendor contact to ask for planning. No response. January 22, 2007: Sixth vendor contact to ask for planning. Scheduled. March 23, 2007: Seventh vendor contact to ask for planning. Re-Scheduled. May 22, 2007: Eigth vendor contact to ask for planning. Re-Scheduled. October 01, 2007: Nineth vendor contact to ask for planning. Patch will be published in October. November 09, 2007: Tenth. Version 48.1.1 has been approved for general release and published. November 13, 2007: Advisory Published. XII. LEGAL NOTICES ------------------------- The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Internet Security Auditors, S.L. accepts no responsibility for any damage caused by the use or misuse of this information.


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top