Affected version: 2.2 and 2.3
Date discovered: 19.01.2011
Eventum suffers from a cross-site scripting vulnerability. The persistent XSS issue is triggered when input passed via the 'keywords' parameter to the list.php script is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML
and script code in a user's browser session in context of an affected site. Or, you can trigger the issue when parsing the string <script>alert(1)</script>' into the search box and it will be stored every time you navigate back to the list.php page. If there's no activity the stored string will self execute every 5 minutes. 'forgot_password.php' and 'select_project.php' are also vulnerable because they fail to perform filtering when using the REQUEST_URI variable.
Tested on: (xampp)
- Microsoft Windows XP Professional SP3 (EN)
- Apache 2.2.14 (Win32)
- PHP 5.3.1
- MySQL 5.1.41
http://127.0.0.1/eventum-2.3/htdocs/list.php?keywords=<script>alert('ZSL')<%2Fscript>
http://127.0.0.1/eventum-2.3/htdocs/forgot_password.php/>"><script>alert('ZSL')</script>
http://127.0.0.1/eventum-2.2/forgot_password.php/>"><script>alert('ZSL')</script>
http://127.0.0.1/eventum-2.2/select_project.php/>"><script>alert('ZSL')</script>
Waiting for confirmation and fix release for advisory release at http://zeroscience.mk
Thanks,
Gjoko
A fix has been committed and we are discussing if we can do a complete release right now, or just release a patch. I will keep you informed, feel free to ping me on IRC to discuss.