exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Zurmo 3.2.6 Persistent Cross Site Scripting

Zurmo 3.2.6 Persistent Cross Site Scripting
Posted Jul 26, 2019
Authored by Daniel Bishtawi, Umran Yildirimkaya | Site netsparker.com

Zurmo version 3.2.6 suffers from a persistent cross site scripting vulnerability.

tags | exploit, xss
SHA-256 | 78dd4cf9cac1ce59afb343a7d09687c57a8237d03c13a57ddf725f905d8fdbfe

Zurmo 3.2.6 Persistent Cross Site Scripting

Change Mirror Download

Stored Cross-site Scripting Vulnerability in Zurmo 3.2.6

Information
--------------------

Advisory by Netsparker
Name: Stored Cross-site Scripting in Zurmo
Affected Software: Zurmo
Affected Versions: 3.2.6
Homepage: http://zurmo.org
Vulnerability: Stored Cross-site Scripting
Severity: Medium
Status: Not Fixed
Netsparker Advisory Reference: NS-19-010

Technical Details
--------------------

URL : http://{DOMAIN}/zurmo/app/index.php/zurmo/group
Injection URL : http://{DOMAIN}/zurmo/app/index.php/zurmo/group/edit?id=11
Parameter Name : Group_bname%5d
Parameter Type : POST
Attack Pattern : <scRipt>alert(‘storedXSS’)</scRipt>

Proof-of-Concept
--------------------

Visit http://{DOMAIN}/zurmo/app/index.php/zurmo/group/create and enter a random group name and save it. Edit the new group from http://{DOMAIN}/zurmo/app/index.php/zurmo/group and replace the name with the attack pattern. Save and navigate back to http://{DOMAIN}/zurmo/app/index.php/zurmo/group . You’ll see the XSS pop up.

Advisory Timeline
--------------------

17th May 2019 - First Attempted Contact
25th July 2019 - Advisory Released

Credits & Authors
--------------------

These issues have been discovered by Umran Yildirimkaya while testing the Netsparker Web Application Security Scanner.

About Netsparker
--------------------

Netsparker web application security scanner finds and reports security flaws and vulnerabilities such as SQL Injection and Cross-site Scripting (XSS) in all websites and web applications, regardless of the platform and technology they are built on. Netsparker scanning engine’s unique detection and exploitation techniques allow it to be dead accurate in reporting vulnerabilities.
Login or Register to add favorites

File Archive:

May 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    44 Files
  • 2
    May 2nd
    5 Files
  • 3
    May 3rd
    11 Files
  • 4
    May 4th
    0 Files
  • 5
    May 5th
    0 Files
  • 6
    May 6th
    28 Files
  • 7
    May 7th
    3 Files
  • 8
    May 8th
    4 Files
  • 9
    May 9th
    54 Files
  • 10
    May 10th
    12 Files
  • 11
    May 11th
    0 Files
  • 12
    May 12th
    0 Files
  • 13
    May 13th
    17 Files
  • 14
    May 14th
    11 Files
  • 15
    May 15th
    17 Files
  • 16
    May 16th
    13 Files
  • 17
    May 17th
    22 Files
  • 18
    May 18th
    0 Files
  • 19
    May 19th
    0 Files
  • 20
    May 20th
    17 Files
  • 21
    May 21st
    18 Files
  • 22
    May 22nd
    7 Files
  • 23
    May 23rd
    0 Files
  • 24
    May 24th
    0 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close