PT-2020-10265

Name of the Vulnerable Software and Affected Versions Serpico version 1.3.0 Description An issue was discovered in Serpico, allowing stored XSS via the author parameter in the "admin/add user/UID" endpoint. Recommendations For Serpico version 1.3.0, avoid using the author parameter in the...

CVE-2019-19854: Cross-Site Request Forgery (CSRF)

An issue was discovered in Serpico aka SimplE RePort wrIting and CollaboratiOn tool 1.3.0. It does not use CSRF Tokens to mitigate against CSRF; it uses the Origin header which must match the request origin. This is problematic in conjunction with XSS: one can escalate privileges from User level ...

CVE-2019-19859: Undefined Security Weakness

An issue was discovered in Serpico aka SimplE RePort wrIting and CollaboratiOn tool 1.3.0. The Add Collaborator allows unlimited data via the author parameter, even if the data does not match anything in the database...

Serpico Cross-Site Scripting Vulnerability (CNVD-2020-03856)

Serpico is a penetration test report generation and collaboration tool. A cross-site scripting vulnerability exists in Serpico version 1.3.0 in admin/listuser, which stems from the lack of proper validation of client-side data by the WEB application and can be exploited by an attacker to execute...

CVE-2019-19855: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Serpico aka SimplE RePort wrIting and CollaboratiOn tool 1.3.0. admin/listuser allows stored XSS via the authtype parameter...

Serpico Cross-Site Scripting Vulnerability (CNVD-2020-03851)

Serpico is a penetration test report generation and collaboration tool. A cross-site scripting vulnerability exists in admin/adduser/UID in Serpico version 1.3.0, which stems from the lack of proper validation of client-side data in a WEB application and can be exploited by an attacker to execute...

PT-2020-10263

Name of the Vulnerable Software and Affected Versions Serpico version 1.3.0 Description An issue was discovered that allows stored XSS via the type parameter in the User Type on the "admin/list user" page. Recommendations For Serpico version 1.3.0, consider restricting access to the "admin/list...

CVE-2019-19856: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Serpico aka SimplE RePort wrIting and CollaboratiOn tool 1.3.0. The User Type on the admin/listuser page allows stored XSS via the type parameter...

Blackhat 2015 Arsenal

Last month at Blackhat Arsenal 2015, Pete and I @willis presented on Serpico. This was our second time at Arsenal. Yet again, awesome people, great venue, and overall a highlight for me of BH/DC/LV. We got some excellent feedback on the project, so thank you to anyone who stopped by. Last year I...

Blackhat 2014 Arsenal Experience

Last week at Blackhat Arsenal 2014, Pete and I @willis presented on Serpico. Arsenal was a great experience and I would highly recommend to anyone as an attendee or presenter. We got some great feedback on the project, so thank you to anyone who stopped by. Here were the top 3 feature requests an...