DATABASE RESOURCES PRICING ABOUT US

{"id": "SECURITYVULNS:DOC:16950", "bulletinFamily": "software", "title": "OTRS <= 2.0.x XSS/XSRF", "description": "---------------------------------------------------------------------------------\r\n| ____ ____.__ __ |\r\n| \ \ / /|__|_______/ |_ __ _______ ___ |\r\n| \ Y / | \_ __ \ __\ | \__ \ \ \/ / |\r\n| \ / | || | \/| | | | // __ \_> < |\r\n| \___/ |__||__| |__| |____/(____ /__/\_ \ |\r\n| \/ \/ |\r\n| Security without illusions |\r\n| www.virtuax.be |\r\n| |\r\n---------------------------------------------------------------------------------\r\n\r\n\r\n Application: OTRS\r\n Vulnerable Versions: <= v2.0.x\r\n Vulnerability: XSS/XSRF\r\n\r\n Vendor: http://www.otrs.org\r\n Vendor Status: Notified\r\n\r\n Found: 07-05-2007\r\n Public Release Date: 07-05-2007\r\n Last modified: 07-05-2007\r\n Author: ciri\r\n E-mail: ciri[a.t]virtuax[d.o.t]be\r\n \r\n reference: http://www.virtuax.be/advisories/Advisory5-07052007.txt\r\n\r\n=================================================================================\r\n\r\nShouts to the VirtuaX Crew & Community!\r\n\r\n=================================================================================\r\n\r\n\r\n\r\nI. Background\r\n-------------\r\n\r\n"OTRS is an Open source Ticket Request System with many features to manage customer\r\ntelephone calls and e-mails. The system is built to allow your support, sales,\r\npre-sales, billing, internal IT, helpdesk, etc. department to react quickly to\r\ninbound inquiries"\r\n by otrs.org\r\n\r\n\r\nII. Vulnerablity\r\n----------------\r\n\r\nOTRS is vulnerable to a XSS/XSRF. It is possible to inject code into the\r\nSubaction parameter. Authentication is required to reach the page, but a\r\nnon-authenticated user will be asked to login and the attack will still be carried\r\nout. XSRF is ofcourse also possible in this case.\r\n\r\nIIa. Affected Versions\r\n----------------------\r\n\r\nOTRS 2.0.4 was tested and appears to be vulnerable. I've tested version 2.2.0 and\r\nit doesn't seem to be vulnerable anymore.\r\n\r\nIII. PoC\r\n--------\r\n\r\nhttp://server/otrs/index.pl?Action=AgentTicketMailbox&Subaction=<img src=\r\nhttps://server/otrs/images/Standard/new-message.png onLoad=javascript:alert('hello');>\r\n\r\nCopyright 2007 by ciri from Virtuax.be All rights reserved. 1", "published": "2007-05-08T00:00:00", "modified": "2007-05-08T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:16950", "reporter": "Securityvulns", "references": [], "cvelist": [], "type": "securityvulns", "lastseen": "2018-08-31T11:10:22", "edition": 1, "viewCount": 594, "enchantments": {"score": {"value": 0.8, "vector": "NONE"}, "dependencies": {"references": [{"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:7676"]}], "rev": 4}, "backreferences": {}, "exploitation": null, "vulnersScore": 0.8}, "affectedSoftware": [], "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1645501217, "score": 1659803227}, "_internal": {"score_hash": "6d72bcc8099208a02035d8069c193b21"}}

{}