bugtraq - eFront Multiple Parameter Cross Site Scripting Vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 3 Jun 2010 18:43:53 +0200
From: "VUPEN Web Security" <advisories@...en.com>
To: <bugtraq@...urityfocus.com>
Subject: eFront Multiple Parameter Cross Site Scripting Vulnerabilities

eFront Multiple Parameter Cross Site Scripting Vulnerabilities

I. BACKGROUND
---------------------

"eFront is a fully flexible eLearning system capable of fulfilling a wide
range of learning needs. With eFront you will discover new ways to perform
training tasks easier and faster, while keeping your people actively
engaged and in shape." from efrontlearning.net

II. VULNERABILITIES
---------------------

VUPEN Web Vulnerability Research Team discovered multiple vulnerabilities in 
eFront.

These issues are caused by input validation errors when processing the
"remote_theme", "name", "system_email", "password_length", "math_server",
"site_motto" and "site_name" parameters, which could be exploited
by attackers to cause arbitrary scripting code to be executed by the user's
browser in the security context of an affected Web site.

III. AFFECTED PRODUCTS
---------------------------

eFront versions prior to 3.6.3 build 7400

IV. SOLUTION
----------------

Upgrade to eFront version 3.6.3 build 7455

V. CREDIT
--------------

These vulnerabilities were discovered by Mohammed Boumediane (VUPEN 
Security)
with help of the VUPEN Web Application Security Scanning (WASS) technology.

VI. VUPEN Web Application Security Scanner (WASS)
----------------------------------------------------

VUPEN Web Application Security Scanner (WASS) is a SaaS security scanning
technology which enables corporations and organizations to identify, track
and remediate security vulnerabilities affecting their web sites and
web applications, prevent criminals from gaining unauthorized access to
sensitive data, and comply with security requirements such as PCI.

VUPEN WASS is based on a proprietary technology developed by VUPEN security
experts, and combines black-box (smart and automated) and grey-box
(signature-based) scanning to accurately identify web vulnerabilities such
as those in the OWASP Top 10 including SQL injection and cross-site 
scripting,
but also real-world vulnerabilities such as shell command injection and
file inclusion.

Read More: http://www.vupen.com/english/wass/

VII. REFERENCES
----------------------

http://www.vupen.com/english/advisories/2010/1333
http://forum.efrontlearning.net/viewtopic.php?f=15&t=2177

VIII. DISCLOSURE TIMELINE
-----------------------------

2010-04-14 - Vendor notified
2010-04-14 - Vendor response
2010-06-02 - Coordinated public Disclosure