[InterN0T] Achievo 1.3.4 - XSS Vulnerability

[security () intern0t net]

Achievo - Cross Site Scripting Vulnerability

Version Affected: 1.3.4 (August 12, 2008) (newest)

Info: Achievo is a flexible web-based resource management tool for business environments.
Achievo's resource management capabilities will enable organisations to support their business processes in a simple, 
but effective manner.

A solution that fits seamlessly to the wishes of every organisation and offers the possibility and freedom to adapt the 
functionality to the needs of the organisation. It will fit into every organisation because Achievo is extremly easy to 
change to your specific situation.

Opinion: Achievo seems to know what they're doing, or perhaps it's just because 99% of the platform is locked down.

Credits: webDEViL (for inspiring me) and all of InterN0T :-)

Googled0rk: (we were unable to produce an accurate d0rk)
inurl:/achievo/index.php intitle:achievo

However, why would One need a Googled0rk when One can just look here?
http://www.achievo.org/product/testimonials/

External Links:
http://www.achievo.org/
http://www.achievo.org/download/
http://www.achievo.org/demo/

Default Admin User:
administrator


-:: The Advisory ::-

Version Information:
http://www.website.tld/achievo/doc/CHANGES

Vulnerable Function / ID Calls: (XSS)
atkaction (this has to be used in conjunction with another main function call!)

Cross Site Scripting: 
1. http://www.website.tld/achievo/index.php?";><script>alert(0)</script><br
Explained: The above has minimal impact as it's almost impossible if not impossible to abuse. This works only when One 
is NOT logged in.

2. http://www.website.tld/achievo/dispatch.php?atknodetype=pim.pim&atkaction=<script>alert(document.cookie)</script>
Explained: The above has greater impact as it will survive a login. This is not filtered as well. This works only when 
One IS logged in.

Additional Information:
If: $config_session_regenerate = false; is set to 'true' in the config.inc.php then the session id's will be 
regenerated on each hit/click preventing session hijacking.


-:: Solution ::-
The most easy solution is to validate user input and strip or convert bad / html characters. Setting the above to true 
might solve the issue partially, however session hijacking is only one of the things you can do with cross site 
scripting.

Conclusion:
Achievo seems generally like a secure system with exception for the above. This advisory didn't contain that much, but 
it's still 1 very minor and 1 minor hole. Basically the exploitation success all relies on the administrator or user 
you execute this attack on.

Reference:
http://forum.intern0t.net/exploits-vulnerabilities-pocs/1053-intern0t-achievo-1-3-4-cross-site-scripting-vulnerability.html

Disclosure Information:
- Vulnerabilities found, researched and confirmed the 27th and 28th May 2009.
- Advisory finished and published on InterN0T the 28th May.
- Bugtraq (SecurityFocus) and Milw0rm contacted the 28th May.
*Achievo will be contacted soon as well.


All of the best,
MaXe