CVE-2011-1509

Related Files

Core Security Technologies Advisory 2011.0506

Posted Sep 14, 2011

Authored by Core Security Technologies, Matias Blanco | Site coresecurity.com

ManageEngine ServiceDesk Plus is a complete web based and ITIL ready service desk software with integrated asset management developed by ManageEngine, the Enterprise IT Management Software division of Zoho Corporation. The authentication process of ServiceDesk Plus obfuscates user passwords using a trivial and symmetrical algorithm in Javascript code with no secret. Given that user passwords are locally stored in user cookies and having the Javascript code to encrypt and decrypt passwords in a .js file, the authentication process of ServiceDesk Plus can be bypassed allowing an attacker to get usernames+passwords of registered users. Additionally, a cross site scripting vulnerability related to search functions was found.

tags | exploit, web, javascript, xss

advisories | CVE-2011-1509, CVE-2011-1510

SHA-256 | dde4e80049f630498c5dd4ccfcde206197f20795d0ce966d739e63494ef820c8

Download | Favorite | View