NACElink CS Manager - Persistent Web Vulnerability

Title:
======
NACElink CS Manager - Persistent Web Vulnerability

Common Vulnerability Scoring System:
====================================
3.5


Introduction:
=============
NACElink Career Services Manager (CSM)™ offers everything you need to smoothly run a career services office.
This powerful and customizable career office management tool allows career professionals to spend more time 
making personal connections with students and employers and less time in front of a computer.

Exclusive software of the NACElink network
The NACElink Network, the result of an alliance among the National Association of Colleges and Employers, 
DirectEmployers Association, and Symplicity Corporation, is a national recruiting network serving the needs 
of colleges, employers and job candidates.

The NACElink Network is the first network of its kind that was formed with commitment for ensuring the privacy 
of student data, allowing no commercial marketing to students or employers, and focusing on the career center 
as the provider of jobs and connections to employers.

(Copy of the Vendor Homepage:  http://www.symplicity.com/career_services_manager_nacelink )

Details:
========
A critical persistent web vulnerability is detected in NACElinks Career Services Manager (CSM).
A user(attacker) will be asked after register to upload his resume in order to user the application 
to apply for different jobs. This resume is getting reviewed by the administrator, and then the user can apply 
to any job. The attacker can inject scipt code as the name of the resume. For example, the attacker can make the 
name of the resume as <h1>resume</h1>. The script code will get injected into the page and it will be executed (persistent). 
If the attacker injects a code to hijack the session, while the administrator is processing to check the resume, the session 
can be transfered and the attacker can login as the administrator. Successful exploitation of the vulnerability results in 
session hijacking admin/mod/customer, persistent panel context manipulation or persistent client exploitation.

Vulnerable Module(s):
				[+] Resume File Upload & Listing

Risk:
=====
The security risk of the persistent web vulnerability is estimated as medium(+).



#  0day.today [2018-02-19]  #