what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Intrexx Professional 6.0 / 5.2 Cross Site Scripting

Intrexx Professional 6.0 / 5.2 Cross Site Scripting
Posted Dec 15, 2014
Authored by Christian Schneider | Site christian-schneider.net

Intrexx Professional suffers from a reflective cross site scripting vulnerability.

tags | advisory, xss
advisories | CVE-2014-2026
SHA-256 | 7e1f202d877049840b07b7d324c3147e199962936a01d0c126c15f3a5a11435e

Intrexx Professional 6.0 / 5.2 Cross Site Scripting

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


CVE-2014-2026
===================
"Reflected Cross-Site Scripting (XSS)" (CWE-79) vulnerability
in "Intrexx Professional" product


Vendor
===================
United Planet GmbH


Product
===================
"Intrexx is an integrated cross-platform development environment for the creation
and operation of web-based applications, enterprise portals and intranet portals."
- source: https://en.wikipedia.org/wiki/Intrexx


Affected versions
===================
This vulnerability affects versions of Intrexx Professional 6.0 (prior to Online Update 10)
and 5.2 (prior to Online Update 0905)


Patch availability
===================
The vendor has released the following fixes:
"Online Update 10" or later for Intrexx Professional 6.0 users
"Online Update 0905" or later for Intrexx Professional 5.2 users


Reported by
===================
This issue was reported to the vendor by Christian Schneider (@cschneider4711)
following a responsible disclosure process.


Severity
===================
Medium


Exploitability
===================
Victim needs to visit malicious webpage of attacker


Description
===================
Using the request parameter of the search functionality it is possible to execute
Reflected Cross-Site Scripting (XSS) attacks. This enables attackers to impersonate
victim users (in context of the origin exposing the portal) when logged-in victims
are accessing attacker supplied links/sites.


Proof of concept
===================
Due to the responsible disclosure process chosen and to not harm unpatched systems,
no concrete exploit code will be presented in this advisory.


References
===================
https://help.unitedplanet.com/?rq_AppGuid=C203A277EDDF9AD2492B776B996B20D4A7C58395&rq_TargetPageGuid=7A91F4B76FFC41A18F4EA4ACE26F31E033C5B018

https://help.unitedplanet.com/?rq_AppGuid=C203A277EDDF9AD2492B776B996B20D4A7C58395&rq_TargetPageGuid=2EBBF802B1970FE31EFC8A34108DF3F47E7A8EEC&rq_RecId=32&rq_SourceAppGuid=C203A277EDDF9AD2492B776B996B20D4A7C58395&rq_SourcePageGuid=7A91F4B76FFC41A18F4EA4ACE26F31E033C5B018&rq_SourceRecId=32#{1}

http://www.christian-schneider.net/advisories/CVE-2014-2026.txt


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (Darwin)

iQIcBAEBAgAGBQJUjhC3AAoJEEDB74comLC+PQEP/3uN8CfRfZWMrWjcjZUl/OQf
d9ohQf1xyHxqC2IARrJcYVTHP1i/4VhnkFGd2Q0yrRqVEzlN84qgyXArkBW9RDkR
OgMkT3oqIERywpq3M9A91Jdb5LrdiFCKPj9kBbcXmsgsgZIPXlJSCQ92IoyepTrL
rYw9mUUkN+qxu07xPS2gdzYtpv51PoW2svZFnQKEbXa9wl8Yw5PcPqvYJkxG/TJv
KDD1U0k9d7Y5mLlvnVil8ANvDoXVD5YrNFX80pHi0hBbMQvchj2OOpq8Mia7IIjK
E4GjfshwZ4XZfSlNEu7ESoKdXxOwbm9M2N5a5DwiuXOwQLh6UKrZRPQMzz6L3HyX
KBjAodTGMPGtO8YHTJVsWIQpsB+gENUudxpcOJ8jnHMOwEp8T0zMHeWjaZpj2Gzm
3jrRjuScT8FzJMEudBSLFwZy+Ce6rC9PA4mmPqNKADW+E32vmt17HV1wO007k84H
LgmBkpvGh+ZefIhCNfKm6i6PfxFePqQZMycAJYwdF1P3IpVRHVW/o45XAyWZHOjU
/wRJpwlETJjSicibVcbx7hZxv1gjPwOoePeyMK6PciD0W3jdjRsABaOfQeJ5gQgL
BGfrziuu0uBnMTFWM5OJD8WW4qdWmgjQEh+xH4HErWOAV5VQJFABmkIfWfVD6vhK
yHJz6lRSMRhhVCxL6E3A
=fTQM
-----END PGP SIGNATURE-----
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close