发布 2013-07-18 漏洞条目

Dell PacketTrap PSA 7.1 – Multiple Cross-Site Scripting Vulnerabilities

Exploit Source

Title:

======

Dell PacketTrap PSA 7.1 - Multiple Persistent Vulnerabilities

Date:

=====

2013-07-18

References:

===========

http://www.vulnerability-lab.com/get_content.php?id=790

VL-ID:

=====

790

Common Vulnerability Scoring System:

====================================

5.6

Introduction:

=============

Purpose built for IT professionals and other service businesses. Streamline the management of projects, clients, staff, assets, and billing.

Software should be intuitive and easy-to-use, not complicated and confusing. That`s why packetTrap has created an easy to use yet powerful

interface that even your techs enjoy using. Whether you are using spreadsheets and sticky notes or clunky software, companies like yours

will surely benefit from the significant time savings and a dramatic increase in profitability. With packetTrap PSA, you now have an

integrated solution that delivers an end-to-end business management solution with real advantages over other options. Service Request Tracking

- Team Scheduling - Customer and Contact Management - Customer Portal - Mobile Friendly - QuickBooks Integration Equipment Tracking Contract

Management - Email Dropbox - SSL Security.

(Copy of the Vendor Homepage: http://www.packettrap.com/ )

Abstract:

=========

The Vulnerability Laboratory Research Team discovered multiple persistent web vulnerabilities in the DELL packetTrap PSA v7.1 web application.

Report-Timeline:

================

2013-01-24: Researcher Notification & Coordination (Ibrahim Mosaad El-Sayed)

2013-02-06: Vendor Notification (Dell Security Team)

2013-02-08: Vendor Response/Feedback (Dell Security Team)

2013-**-**: Vendor Fix/Patch (Developer Team)

2013-07-18: Public Disclosure (Vulnerability Laboratory)

Status:

========

Published

Affected Products:

==================

DELL

Product: PacketTrap PSA 7.1

Exploitation-Technique:

=======================

Remote

Severity:

=========

High

Details:

========

Multiple persistent input validation vulnerabilities are detected in the DELL packetTrap PSA v7.1 web application.

The bug allows remote attackers to implement/inject own malicious script code on the application side of the system (persistent).

Exploitation of persistent issues mostly requires a low privilege application user account and an user interaction click or input.

The 1st persistent web vulnerability is located in the contracts module when processing to request a via POST method manipulated

txtContractName parameter. The vulnerability allows remote attackers to inject own malicious script code with persistent vector

in a vulnerable value which is also in use by the contract module when processing to display (list) the context (output).

The result is the persistent execution of script code in the contract overview listing.

The 2nd persistent web vulnerability is located in the Equipment Item module when processing to request a via POST method manipulated

lblPurchaseInfo parameter. The vulnerability allows remote attackers to inject own malicious script code with persistent vector

in a vulnerable value which is also in use by the Equipment Item module when processing to display (list) the context (output).

The result is the persistent execution of script code in the Equipment Item listing.

The 3rd persistent web vulnerability is located in the Import Customer Equipment Records module when processing to request a via

POST method manipulated gridItem parameter. The vulnerability allows remote attackers to inject own malicious script code with

persistent vector in a vulnerable value which is also in use by the Import Customer Equipment Records module when processing to

display (list) the context (output). The result is the persistent execution of script code in the Import Customer Equipment Records listing.

The 4th part of the persistent web vulnerabilities are located in the Labor Rate module when processing to request via POST method

manipulated lblItemNo, lblDescription, lblAccountName & lblNotes parameters. The vulnerabilities allow remote attackers to inject

own malicious script code with persistent vector in a vulnerable value which is also in use by the Labor Rate module when processing to

display (list) the context (output). The result is the persistent execution of script code in the Labor Rate listing.

The 5th part of the persistent web vulnerabilities are located in the Materials Item module when processing to request via POST method

manipulated lblMfrName, lblMfrItemNo, lblMfrDescription, lblAccountName & lblNotes parameters. The vulnerabilities allow remote attackers

to inject own malicious script code with persistent vector in a vulnerable value which is also in use by the Materials Item module when

processing to display (list) the context (output). The result is the persistent execution of script code in the Materials Item listing.

The 6th part of the persistent web vulnerabilities are located in the New customer module when processing to request via POST method

manipulated lblPrimaryContact & lblPrimaryLocation parameters. The vulnerabilities allow remote attackers to inject own malicious script code

with persistent vector in a vulnerable value which is also in use by the New customer module when processing to display (list) the context (output).

The result is the persistent execution of script code in the New customer listing.

The 7th persistent web vulnerability is located in the Report module when processing to request a via POST method manipulated

lblPageTitle parameter. The vulnerability allows remote attackers to inject own malicious script code with persistent vector

in a vulnerable value which is also in use by the Report module when processing to display (list) the context (output).

The result is the persistent execution of script code in the Report overview listing.

Exploitation of the vulnerability requires a low privilege web-application user account and low or medium user interaction.

Successful exploitation of the vulnerability results in session hijacking (manager/admin) with persistent vector, persistent phishing,

persistent external redirects to malware, exploits or scripts and persistent manipulation of module context.

Vulnerable Module(s):

[+] Contract - PacketTrap PSA

[+] Equipment Item - PacketTrap PSA

[+] Import Customer Equipment Records - PacketTrap PSA

[+] Labor Rate - PacketTrap PSA

[+] Materials Item - PacketTrap PSA

[+] New customer - PacketTrap PSA

[+] Report x ApplicationName - PacketTrap PSA

Vulnerable Parameter(s):

[+] txtContractName

[+] lblPurchaseInfo

[+] gridItem

[+] lblItemNo, lblDescription, lblAccountName & lblNotes

[+] lblMfrName, lblMfrItemNo, lblMfrDescription, lblAccountName & lblNotes

[+] lblPrimaryContact & lblPrimaryLocation

[+] lblPageTitle

Affected Section(s):

[+] Contract Overview & Edit - Listing

[+] Equipment Item Overview & Edit - Listing

[+] Import Customer Equipment Records Overview - Listing

[+] Labor Rate Details - Listing

[+] Materials Item Overview - Listing

[+] New customer Account Details - Listing

[+] Report - Listing

Proof of Concept:

=================

The persistent script code inject vulnerabilities can be exploited by low privileged group user accounts with low required user interaction.

For demonstration or reproduce ...

Review: Contract Overview & Edit - Listing

<h1>Contract: <span id="lblPageTitle">"><[PERSISTENT INJECTED SCRIPT CODE!]></span></h1>

<h2><a href="https://vl.packettrappsa.com/customers/customer.aspx?customerId=33628564"><span id="lblCustomerName">Sample Customer</span></a></h2>

</div>

... &

<td style="width:130px;" class="formLabel">Contract Name:</td>

</td>

</tr>

Review: Equipment Item Overview & Edit - Listing

Purchase Info.:

</td>

<td>

<span id="lblPurchaseInfo">Purchased on Dec 11, 2012 from "><[PERSISTENT INJECTED SCRIPT CODE!]></span>

</td>

</tr>

Review: Import Customer Equipment Records Overview - Listing

</tr><tr class="gridItem" valign="top">

</td></tr><tr class="gridItem" valign="top">

<td>phpinfo();</td> O_O

</tr><tr class="gridItem" valign="top">

</tr><tr class="gridItem" valign="top">

</tr>

</table>

Review: Labor Rate Details - Listing

Name/No.:</td>

<td>

</td>

</tr>

<tr>

<td class="formLabel">Description:</td>

<td>

</tr>

... &

<td class="formLabel">Account Name:</td>

<td>

</tr>

Review: Materials Item Overview - Listing

</td>

</tr>

<tr>

Description:</td>

<td>

</tr>

... &

</tr>

<tr>

<td style="width:130px;" class="formLabel">Manufacturer:</td>

</tr>

<td>

</tr>

<td>

</tr>

... &

<tr><td class="formLabel">Account Name:</td>

<td>

</tr>

<tr>

</tr>

<tr>

<td>

</tr>

<tr>

<td class="formLabel">Created:</td>

<td>

<span id="lblCreated">by the storm on Dec 9, 2012 at 5:11 PM</span></td>

</tr>

<tr>

</tr>

<tr>

<td class="formLabel">Notes:</td>

<td>

</tr>

Review: New customer Account Details - Listing

<strong>Primary Contact:</strong>

</td>

<span id="lblPrimaryContact"><a href="https://vl.packettrappsa.com/customers/contact.aspx?customerId=33628565&

contactId=33637457">"><iframe src=http://www. "><iframe src=http://www.</a>, () -,

</td>

</tr>

<tr>

<td>

<strong>Primary Location:</strong>

</td>

<td>

<span id="lblPrimaryLocation"><a href="https://vl.packettrappsa.com/customers/location.aspx?customerId=33628565&

locationID=33649992">"><[PERSISTENT INJECTED SCRIPT CODE!]</a>, "><[PERSISTENT INJECTED SCRIPT CODE!]>

(<a href="https://vl.packettrappsa.com/tools/getMap.aspx?customerLocationId=33649992" class="map-link">Get Map</a>)</span>

</td>

</tr>

</tbody>

Review: Report - Listing

</div>

<span class="ui-corner-tr">Time Frame</span>

</div>

Risk:

=====

The security risk of the persistent input validation vulnerabilities are estimated as high(-).

Credits:

========

Vulnerability Laboratory [Research Team] - Ibrahim El-Sayed (the_storm) [ibrahim@evolution-sec.com]

Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri [bkm@evolution-sec.com]

Disclaimer:

===========

The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties,

either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-

Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business

profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some

states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation

may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases

or trade with fraud/stolen material.

Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com

Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com

Section: www.vulnerability-lab.com/dev - forum.vulnerability-db.com - magazine.vulnerability-db.com

Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab

Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.

Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other

media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and

other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),

modify, use or edit our material contact (admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission.

VULNERABILITY LABORATORY RESEARCH TEAM

DOMAIN: www.vulnerability-lab.com

CONTACT: research@vulnerability-lab.com

作者: Vulnerability-Lab
日期: 2013-07-18
类别: webapps
平台: windows

相关漏洞条目

Prodigy Commerce 3.3.0 – Local File Inclusion

Langflow 1.3.0 – Remote Code Execution

Quick Playground for WordPress 1.3.1 – Unauthenticated Remote Code Execution

MikroORM 7.0.13 – SQL Injection