Netautor Professional 5.5.0 (goback) XSS Vulnerability

🗓️ 17 Sep 2010 00:00:00Reported by Gjoko KrsticType

zeroscience🔗 www.zeroscience.mk👁 123 Views

Netautor Professional 5.5.0 XSS Vulnerability in goback Paramete

Reporter	Title	Published	Views	Family All 8
Circl	CVE-2010-3489	17 Sep 201000:00	–	circl
CVE	CVE-2010-3489	22 Sep 201019:00	–	cve
Cvelist	CVE-2010-3489	22 Sep 201019:00	–	cvelist
EUVD	EUVD-2010-3487	7 Oct 202500:30	–	euvd
NVD	CVE-2010-3489	22 Sep 201020:00	–	nvd
OpenVAS	Netautor Professional 'login2.php' XSS Vulnerability	5 Oct 201000:00	–	openvas
Prion	Cross site scripting	22 Sep 201020:00	–	prion
RedhatCVE	CVE-2010-3489	22 May 202505:10	–	redhatcve

<html><body><p>Netautor Professional 5.5.0 (goback) XSS Vulnerability


Vendor: /digiconcept/
Product web page: http://www.digiconcept.net
Affected version: 5.5.0 and DW 5.3.1


Summary: Netautor Professional is an application server and
development environment. Netautor Professional was developed
to serve the practical needs of users, and was continuously
advanced.
--
Digital Workroom is a well proven and time-tested Content Management
System. It`s based on also digiconcept`s developed Application Server
"Netautor Professional" and PHP 5. The standard functional range covers
the majoritarian needs on Internet- and Intranet environments for publication
and communication.


Desc: Netautor Professional v5.5.0 suffers from a XSS vulnerability because
input passed via the "goback" parameter to login2.php script is not properly
sanitised before being returned to the user. This can be exploited to execute
arbitrary HTML and script code in a user's browser session in context of an
affected site.


----------------------------- [FILE] :: [LINE#] :: [STRING] -----------------------------

\ROOT\digitalworkroom\exports\DW_5.3\mlayouts_262527331.xml :: 532 :: unset($GLOBALS['goback']);
\ROOT\digitalworkroom\exports\DW_5.3\mlayouts_262527331.xml :: 536 :: if(!empty($GLOBALS['goback'])) $values['USER_TARGET'][0] = $GLOBALS['goback'];
\ROOT\digitalworkroom\exports\DW_5.3\mlayouts_262527331.xml :: 575 :: /* Auf GLOBALS['goback'] von NPF_SECURE reagieren*/
\ROOT\digitalworkroom\exports\DW_5.3\mlayouts_262527331.xml :: 661 :: &lt;?php if (empty( $GLOBALS['goback'])): ?&gt;
\ROOT\netautor\napro4\home\login2.msk :: 49 :: <input name="goback" type="hidden" value="&lt;?php echo($goback); ?&gt;"/>
\ROOT\netautor\napro4\home\login2.php :: 38 :: if(empty($goback)) $goback = $USER-&gt;get_feature_value('initial_doc');
\ROOT\netautor\napro4\include\functions\users.fnc :: 822 :: if (!strpos($url,'&amp;goback=')) $url.='&amp;goback='.rawurlencode($PHP_SELF);
\ROOT\netautor\napro4\include\npf_lib\npf_special.fnc :: 155 :: $redirect.=( strpos($redirect,'?') ? '&amp;' : '?' ).'goback='.rawurlencode( $REQUEST_URI );

-----------------------------------------------------------------------------------------


Tested on: MS WinXP Pro SP3 (EN)
           PHP 5.3.0
           MySQL 5.1.36
           Apache 2.2.11 (Win32)


Vendor status: [14.09.2010] Vulnerability discovered.
               [15.09.2010] Contact with the vendor.
               [17.09.2010] No reply from vendor.
               [17.09.2010] Public advisory released.


Vulnerability discovered by: Gjoko 'LiquidWorm' Krstic
                             liquidworm gmail com
                             Zero Science Lab - http://www.zeroscience.mk


Advisory ID: ZSL-2010-4964
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4964.php


PoC:

 http://10.0.0.17/netautor/napro4/home/login2.php?goback=%22%3Cscript%3Ealert%28document.location%29%3C/script%3E
</p></body></html>

17 Sep 2010 00:00Current

6.1Medium risk

Vulners AI Score6.1

CVSS 24.3

EPSS0.01956