# Affected software: Feng Office - URL: http://www.fengoffice.com/web/demo.php # Discovered by: Provensec # Website: http://www.provensec.com # Type of vulnerability: XSS Stored # # Feng Office is a Collaboration tool that includes a CRM, Communication, Document Management, Tasks, E-mails, Documents, Internal messages, Time tracking, Billing, Calendar, Gantt Charts, Reminders, and more. # # Description: Feng Office is prone to a Persistent Cross Site Scripting attack that allows a malicious user to inject HTML or scripts that can access any cookies, session tokens, or other sensitive information retained by your browser and used with that site. # Proof of concept: # 1. Create or Edit a client # 2. Complete the field Name ( customer[name] ) using this value: "><script>alert('XSS by Provensec')</script> # 3. Save changes. # 4. Share your client in the Activity feed to infect others.
Related ExploitsOther Possible E-DB Search Terms: Feng Office
|2012-11-21||Feng Office - Security Bypass / HTML Injection||Ur0b0r0x|
|2011-04-01||Feng Office 184.108.40.206 - Cross-Site Request Forgery||High-Tech Bridge SA|
|2014-10-23||Feng Office 1.7.4 - Arbitrary File Upload||AutoSec Tools|
|2014-10-23||Feng Office 1.7.4 - Cross-Site Scripting||AutoSec Tools|