Vulners
Lucene search
Xplico 0.5.7 (add.ctp) Remote XSS Vulnerability
🗓️ 02 Jul 2010 00:00:00Reported by Maximiliano Soler and Marcos GarciaType 
zeroscience🔗 www.zeroscience.mk👁 13 Views
<html><body><p>Xplico v0.5.7 (add.ctp) Remote XSS Vulnerability
Title: Xplico v0.5.7 (add.ctp) Remote XSS Vulnerability
Type: Remote
Impact: Cross-Site Scripting
Release Date: 02.07.2010
Release mode: Coordinated release
Summary
=======
The goal of Xplico is extract from an internet traffic capture the applications
data contained. For example, from a pcap file Xplico extracts each email (POP, IMAP,
and SMTP protocols), all HTTP contents, each VoIP call (SIP), FTP, TFTP, and so on.
Xplico isn�t a network protocol analyzer. Xplico is an open source Network Forensic
Analysis Tool (NFAT).
Description
===========
Xplico is vulnerable to Cross-Site Scripting vulnerability. An attacker can use the
"POST" to take advantage of this vulnerability, injecting code into the web pages
viewed by other users.
--------------------------------------------------------------------------------
Detecting vulnerabilities
- /opt/xplico/xi/app/views/pols/add.ctp:13
- /opt/xplico/xi/app/views/pols/add.ctp:14
- /opt/xplico/xi/app/views/sols/add.ctp:10
--------------------------------------------------------------------------------
Vendor
======
Xplico Team - http://www.xplico.org
Affected Version
================
0.5.7
PoC
===
- /opt/xplico/xi/app/views/pols/add.ctp:13
echo $form->input('Pol.name', array('maxlength'=> 50, 'size' => '50','label' => 'Case
name&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp&nbsp'));
Attack: Case name=[XSS] (POST)
Credits
=======
Vulnerability discovered by Marcos Garcia (@artsweb) and Maximiliano Soler (@maxisoler).
Solution
========
Upgrade to Xplico v0.5.8 (http://sourceforge.net/projects/xplico/files/)
Vendor Status
=============
[22.06.2010] Vulnerability discovered.
[22.06.2010] Vendor informed.
[22.06.2010] Vendor replied.
[24.06.2010] Asked vendor for confirmation.
[24.06.2010] Vendor confirms vulnerability.
[24.06.2010] Asked vendor for status.
[24.06.2010] Vendor replied.
[29.06.2010] Vendor reveals patch release date.
[29.06.2010] Coordinated public advisory.
References
==========
[1] http://www.xplico.org/archives/710
Changelog
=========
[02.07.2010] - Initial release
Web: http://www.zeroscience.mk
e-mail: [email protected] </p></body></html>Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
02 Jul 2010 00:00Current
5.9Medium risk
Vulners AI Score5.9