VTLS.web.gateway cgi is vulnerable to XSS

Advisory Content :

=============================================
INTERNET SECURITY AUDITORS ALERT 2006-004
- Original release date: April 18, 2006
- Last revised: November 13, 2007
- Discovered by: Jesus Olmos Gonzalez
- Severity: 1/5
=============================================

I. VULNERABILITY
-------------------------
VTLS.web.gateway cgi is vulnerable to XSS

II. BACKGROUND
-------------------------
vtls.web.gateway cgi is a product from Visionary Technology in Library
Solutions.

VTLS Inc. is a leading global company that creates and provides
visionary technology in library solutions.

The company provide these solutions to a diverse customer base of more
than 900 libraries in over 32 countries.

III. DESCRIPTION
-------------------------
VTLS is vulnerable to a cross site scripting attack, it is possible to
execue html and javascript code in the browser of who cliks in a
malicious crafted link.

Here is a simple proof of concept that change html page as example. An
attacker could intercept the keyboard, or make CSRF to submit a form
of other page.

IV. PROOF OF CONCEPT
-------------------------
http://somevtlsweb.net/cgi-bin/vtls/vtls.web.gateway?authority=1&searcht
ype=subject%22%3E%3Ch1%3E%3Cmarquee%3EXSS%20bug%3C/marquee%3E%3C/h1%3E%3
C!--&kind=ns&conf=080104+++++++

VI. SYSTEMS AFFECTED
-------------------------
All with this solution up to 48.1.0

VII. SOLUTION
-------------------------
Update to Version 48.1.1

VII. SOLUTION
-------------------------
Update to Version 48.1.1

VIII. REFERENCES
-------------------------
www.vtls.com

IX. CREDITS
-------------------------
This vulnerability has been discovered and reported by
Jesus Olmos Gonzalez (jolmos (at) isecauditors (dot) com).

X. REVISION HISTORY
-------------------------
April 18, 2006: Initial release.
November 13, 2007: Last revision.

XI. DISCLOSURE TIMELINE
-------------------------
February 27, 2006: The vulnerability discovered by
Internet Security Auditors.
April 18, 2006: Initial vendor notification sent.
No response
April 26, 2006: Second vendor notification sent.
Ping pong responses.
September 14, 2006: Third vendor notification sent.
No response.
December 01, 2006: Fourth vendor notification sent.
No response.
December 04, 2006: New patch coming.
No schedule.
January 02, 2007: Fifth vendor contact to ask for planning.
No response.
January 22, 2007: Sixth vendor contact to ask for planning.
Scheduled.
March 23, 2007: Seventh vendor contact to ask for planning.
Re-Scheduled.
May 22, 2007: Eigth vendor contact to ask for planning.
Re-Scheduled.
October 01, 2007: Nineth vendor contact to ask for planning.
Patch will be published in October.
November 09, 2007: Tenth. Version 48.1.1 has been approved for
general release and published.
November 13, 2007: Advisory Published.

XII. LEGAL NOTICES
-------------------------
The information contained within this advisory is supplied "as-is"
with no warranties or guarantees of fitness of use or otherwise.
Internet Security Auditors, S.L. accepts no responsibility for any
damage caused by the use or misuse of this information.

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason

VTLS.web.gateway cgi is vulnerable to XSS