Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

INTER-Mediator – Multiple Cross-Site Scripting (XSS) #772

Closed
bestshow opened this issue Mar 3, 2017 · 2 comments
Closed

INTER-Mediator – Multiple Cross-Site Scripting (XSS) #772

bestshow opened this issue Mar 3, 2017 · 2 comments
Milestone

Comments

@bestshow
Copy link

bestshow commented Mar 3, 2017

Product: INTER-Mediator
Download: https://github.com/INTER-Mediator/INTER-Mediator
Vunlerable Version: 5.5 and probably prior
Tested Version: 5.5
Author: ADLab of Venustech

Advisory Details:
Multiple Cross-Site Scripting (XSS) were discovered in“INTER-Mediator 5.5”, which can be exploited to execute arbitrary code.
The vulnerabilities exist due to insufficient filtration of user-supplied data in the “c” HTTP POST parameter and in the “cred” HTTP POST parameter passed to the “INTER-Mediator-master/Auth_Support/PasswordReset/resetpassword.php” URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
The exploitation examples below use the "alert()" JavaScript function to see a pop-up messagebox:
Poc:
(1)
POST parameter : cred
Value : " /><script>alert(1);</script><
To:
http://localhost/.../INTER-Mediator-master/Auth_Support/PasswordReset/resetpassword.php
(2)
http://localhost/.../INTER-Mediator-master/Auth_Support/PasswordReset/resetpassword.php?c=%22%3E%3Cscript%3Ealert(1);%3C/script%3E%3C%22

@matsuo matsuo added this to the 5.6 milestone Mar 5, 2017
@matsuo
Copy link
Member

matsuo commented Mar 5, 2017

Thanks for your reporting.

@matsuo
Copy link
Member

matsuo commented Jun 23, 2017

INTER-Mediator 5.6 released.
https://github.com/INTER-Mediator/INTER-Mediator/releases/tag/5.6

@matsuo matsuo closed this as completed Jun 23, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants