Douran Portal Arbitrary File Upload and Cross Site Scripting Vulnerabilities
BID:44594
Info
Douran Portal Arbitrary File Upload and Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 44594 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 01 2010 12:00AM |
| Updated: | Nov 01 2010 12:00AM |
| Credit: | ItSecTeam |
| Vulnerable: |
Douran Portal Douran Portal 3.9.7.55 |
| Not Vulnerable: | |
Discussion
Douran Portal Arbitrary File Upload and Cross Site Scripting Vulnerabilities
Douran Portal is prone to an arbitrary-file-upload vulnerability and a cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied input.
Attackers can exploit these issues to upload and execute arbitrary ASP code in the context of the webserver process, steal cookie-based authentication information, execute arbitrary client-side scripts in the context of the browser, and obtain sensitive information. Other attacks are also possible.
Douran Portal versions 3.9.7.55 and prior are vulnerable.
Douran Portal is prone to an arbitrary-file-upload vulnerability and a cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied input.
Attackers can exploit these issues to upload and execute arbitrary ASP code in the context of the webserver process, steal cookie-based authentication information, execute arbitrary client-side scripts in the context of the browser, and obtain sensitive information. Other attacks are also possible.
Douran Portal versions 3.9.7.55 and prior are vulnerable.
Exploit / POC
Douran Portal Arbitrary File Upload and Cross Site Scripting Vulnerabilities
Attackers can exploit these issues through a browser. To exploit a cross-site scripting vulnerability, an attacker must entice an unsuspecting user to follow a malicious URI.
The following example URIs are available:
http://www.example.com/DesktopModules/Gallery/OrderForm.aspx?itemtitle=<script>alert('ITSecTeam')</script>
Attackers can exploit these issues through a browser. To exploit a cross-site scripting vulnerability, an attacker must entice an unsuspecting user to follow a malicious URI.
The following example URIs are available:
http://www.example.com/DesktopModules/Gallery/OrderForm.aspx?itemtitle=<script>alert('ITSecTeam')</script>
Solution / Fix
Douran Portal Arbitrary File Upload and Cross Site Scripting Vulnerabilities
Solution:
Vendor updates are available. Please contact the vendor for more information.
Solution:
Vendor updates are available. Please contact the vendor for more information.
References
Douran Portal Arbitrary File Upload and Cross Site Scripting Vulnerabilities
References:
References:
- Vendor Homepage (Douran)