eventum issue tracking system 2.3.1 - Persistent Cross-Site Scripting

2011-02-19T00:00:00
ID EXPLOITPACK:8D86D9AE85D35332AC9AECAEEC44E55D
Type exploitpack
Reporter Saif El-Sherei
Modified 2011-02-19T00:00:00

Description

eventum issue tracking system 2.3.1 - Persistent Cross-Site Scripting

                                        
                                            # Exploit Title: Eventum 2.3.1 stored XSS
# Date: 19-2-2011
# Author: Saif El-Sherei
# Software Link: https://code.launchpad.net/eventum
# Version: Eventum 2.3.1
# Tested on: FF 3.0.15, IE 8
# Vendor notification: vendor notified, awaiting response
 
Info:

Eventum is a user-friendly and flexible issue tracking system that can be used by a support department to track incoming technical support requests, or by a software development team to quickly organize tasks and bugs. 
 
Details:

The "Full-Name" variable is not properly sanitized before displayed in any page. where an authorized user can perform this attack on other users who has access to the system, by changing his own "full-name" in the preferences section.
 
POC:

<script>alert('w00t');</script>