CVE-2020-26565

ObjectPlanet Opinio before 7.14 is vulnerable to an Expression Language Injection via the admin/permissionList.do parameter, allowing retrieval of potentially sensitive serverInfo data. The issue affects Opinio versions prior to 7.14; remediation is upgrading to 7.14 or later. PoCs and public wri...

CVE-2020-26564

ObjectPlanet Opinio is affected by XXE in versions before 7.15. The vulnerability arises from a sequence where an attacker modifies a CSS file to include an ENTITY, creates an XML that references that CSS, and imports the XML via the survey admin interface, enabling an XXE that can be triggered d...

CVE-2020-26564

ObjectPlanet Opinio before 7.15 allows XXE attacks via three steps: modify a .css file to have !ENTITY content, create a .xml file for a generic survey template containing a link to this .css file, and import this .xml file at the survey/admin/folderSurvey.do?action=viewImportSurvey'importFile'...

CVE-2020-26806

ObjectPlanet Opinio is affected by CVE-2020-26806 in versions before 7.15. The vulnerability allows Unrestricted File Upload of executable JSP files via admin/file.do, enabling remote code execution because filePath can be traversed and fileContent can contain JSP. The issue is demonstrated as an...

CVE-2020-26565: Improper Neutralization of Special Elements used in an Expression Language Statement

ObjectPlanet Opinio before 7.14 allows Expression Language Injection via the admin/permissionList.do from parameter. This can be used to retrieve possibly sensitive serverInfo data...

CVE-2020-26806: Improper Limitation of a Pathname to a Restricted Directory

admin/file.do in ObjectPlanet Opinio before 7.15 allows Unrestricted File Upload of executable JSP files, resulting in remote code execution, because filePath can have directory traversal and fileContent can be valid JSP code...

PT-2021-11251

Name of the Vulnerable Software and Affected Versions: ObjectPlanet Opinio versions prior to 7.15 Description: The issue allows XXE attacks through a three-step process: modifying a .css file to include !ENTITY content, creating a .xml file for a generic survey template that links to this .css...

PT-2021-11252

Name of the Vulnerable Software and Affected Versions: ObjectPlanet Opinio versions prior to 7.14 Description: The issue allows Expression Language Injection via the "admin/permissionList.do" endpoint from a parameter. This can be used to retrieve possibly sensitive serverInfo data...

PT-2021-11276

Name of the Vulnerable Software and Affected Versions: ObjectPlanet Opinio versions prior to 7.15 Description: The issue allows Unrestricted File Upload of executable JSP files, resulting in remote code execution. This is because the filePath can have directory traversal and the fileContent can b...

CVE-2020-26564: Improper Restriction of XML External Entity Reference

ObjectPlanet Opinio before 7.15 allows XXE attacks via three steps: modify a .css file to have !ENTITY content, create a .xml file for a generic survey template containing a link to this .css file, and import this .xml file at the survey/admin/folderSurvey.do?action=viewImportSurvey'importFile'...

CVE-2020-26563

ObjectPlanet Opinio before 7.14 allows reflected XSS via the survey/admin/surveyAdmin.do?action=viewSurveyAdmin query string. There is also stored XSS if input to survey/admin/.do is accepted from untrusted users...

Cross site scripting

ObjectPlanet Opinio before 7.14 allows reflected XSS via the survey/admin/surveyAdmin.do?action=viewSurveyAdmin query string. There is also stored XSS if input to survey/admin/.do is accepted from untrusted users...

CVE-2020-26563

ObjectPlanet Opinio before 7.14 is vulnerable to reflected XSS via the survey/admin/surveyAdmin.do?action=viewSurveyAdmin query string, with stored XSS if inputs to survey/admin/*.do come from untrusted users. Affected versions are prior to 7.14; a fix/patch was provided by ObjectPlanet (referenc...

CVE-2020-26563

ObjectPlanet Opinio before 7.14 allows reflected XSS via the survey/admin/surveyAdmin.do?action=viewSurveyAdmin query string. There is also stored XSS if input to survey/admin/.do is accepted from untrusted users...

CVE-2020-26563: Improper Neutralization of Input During Web Page Generation

ObjectPlanet Opinio before 7.14 allows reflected XSS via the survey/admin/surveyAdmin.do?action=viewSurveyAdmin query string. There is also stored XSS if input to survey/admin/.do is accepted from untrusted users...

ObjectPlanet Opinio 代码问题漏洞

ObjectPlanet Opinio is an online survey system from ObjectPlanet Norway. A code issue vulnerability exists in ObjectPlanet Opinio versions prior to 7.15, which stems from a program that allows XXE attacks by modifying a css file and importing this .xml file in the survey administration folder...

ObjectPlanet Opinio 7.13 / 7.14 XML Injection

Exploit Authors: Timothy Tan , Daniel Tan, Yu EnHui, Khor Yong Heng CVE: CVE-2020-26564 Exploit Title: ObjectPlanet Opinio version 7.13/7.14 allows XXE injection Vendor Homepage: https://www.objectplanet.com/opinio/ Software Link: https://www.objectplanet.com/opinio/ Exploit Authors: Timothy Tan ...

PT-2021-11250

Name of the Vulnerable Software and Affected Versions: ObjectPlanet Opinio versions prior to 7.14 Description: The issue allows for reflected XSS via the "survey/admin/surveyAdmin.do?action=viewSurveyAdmin" query string. Additionally, there is a risk of stored XSS if input to "survey/admin/.do" i...

ObjectPlanet Opinio 7.13 / 7.14 XML Injection Vulnerability

Exploit Authors: Timothy Tan , Daniel Tan, Yu EnHui, Khor Yong Heng CVE: CVE-2020-26564 Exploit Title: ObjectPlanet Opinio version 7.13/7.14 allows XXE injection Vendor Homepage: https://www.objectplanet.com/opinio/ Software Link: https://www.objectplanet.com/opinio/ Exploit Authors: Timothy Tan ...

ObjectPlanet Opinio 7.13 Expression Language Injection Vulnerability

Exploit Authors: Timothy Tan , Daniel Tan, Yu EnHui, Khor Yong Heng CVE: CVE-2020-26565 Exploit Title: ObjectPlanet Opinio version 7.13 allows expression language injection Vendor Homepage: https://www.objectplanet.com/opinio/ Software Link: https://www.objectplanet.com/opinio/ Exploit Authors:...