Zoho OpManager < v12

[d_fens () redbrick dcu ie]

Reported these 27/08/2015 these were eventually fixed in version 12 because the entire application is based on emberjs 
now. There are no CVEs for these issues assigned nor is there any acknowledgement of the issues in any patches. 
Therefore only version 12 fixes these.

Multiple stored and reflected XSS as well as CSRF. There are also multiple issues related to content-type and one 
related to overwriting local files that wasn't reported and passwords being disclosed. Basically prior to version 12 
opmanager is riddled with security issues

The following are stored XSS:
/admin/ConfigURLMonitor.do [fieldname]
/admin/MaintenanceTask.do [selectedAvailableDevices]
/admin/MaintenanceTask.do [selectedDevicesToMove]
/admin/ScheduleMgmt.do [repName]
/api/json/admin/getSysLogForwarders [destHost]
/api/json/device/getDeviceSummary [clName]
/api/json/reports/getReportsList [repName]
/devices/AddNewCF.do [fieldname]
/devices/DeviceCustomFields.do [fieldname]
/devices/manageUnmanage.do [fieldname]
/devices/manageUnmanage.do [fieldname]
/reports/ReportsIndex.do [repName]
/reports/ReportsIndex.do [repName]

The following are reflected XSS attacks
/admin/AddDeviceTypeForm.do [oid]
/admin/AddDeviceTypeForm.do [operationmode]
/admin/ConfigURLMonitor.do [ipAddress]
/admin/DependencyList.do [selectedTab]
/admin/DependencyList.do [selectedTab]
/admin/DeviceAssociation.do [selectedTab]
/admin/EditDeviceGraph.do [operation]
/admin/InvokeDeviceType.do [PAGE_NUMBER]
/admin/MaintenanceTask.do [selectedAvailableDevices]
/admin/MaintenanceTask.do [selectedDevicesToMove]
/admin/MaintenanceTask.do [taskID]
/admin/MibTool.do [selectedmib]
/admin/SNMPTrapProcessors.do [PAGE_NUMBER]
/admin/SNMPTrapProcessors.do [PAGE_NUMBER]
/admin/SNMPTrapProcessors.do [operation]
/admin/SNMPTrapProcessors.do [operation]
/admin/SNMPTrapProcessors.do [operation]
/admin/SNMPTrapProcessors.do [operation]
/admin/ServiceConfiguration.do [operation]
/admin/ServiceConfiguration.do [operation]
/admin/ServiceConfiguration.do [operation]
/admin/SetupSDesk.do [AutoSync]
/admin/SetupSDesk.do [Merge]
/admin/SetupSDesk.do [ticketType]
/admin/SysLogRules.do [SysLogPort]
/admin/SysLogRules.do [SysLogPort]
/admin/SysLogRules.do [status]
/admin/TrapConfiguration.do [PAGE_NUMBER]
/admin/TrapConfiguration.do [status]
/admin/ViewFailoverDetails.do [endDate]
/admin/ViewFailoverDetails.do [endDate]
/admin/ViewFailoverDetails.do [endHour]
/admin/ViewFailoverDetails.do [endHour]
/admin/ViewFailoverDetails.do [startDate]
/admin/ViewFailoverDetails.do [startDate]
/admin/ViewFailoverDetails.do [startHour]
/admin/ViewFailoverDetails.do [startHour]
/admin/ViewFailoverDetails.do [viewLength]
/customDashboard.do [dashboardName]
/devices/AddNewCF.do [fieldname]
/devices/AddNewCF.do [type]
/devices/CustomLinks.do [name]
/devices/DeviceCustomFields.do [type]
/devices/Search.do [searchTerm]
/devices/deviceinfo.do [devicename]
/devices/graphview.do [name]
/devices/manageUnmanage.do [displayName]
/devices/manageUnmanage.do [ipAddress]
/devices/objectdetails.do [displayName]
/devices/objectdetails.do [ipAddress]
/devices/updateStatus.do [displayName]
/devices/updateStatus.do [ipAddress]
/fault/AlarmView.do [displayName]
/map/AddFileMonitor.do [devicename]
/map/AddFileMonitor.do [displayName]
/map/AddFileMonitor.do [ipAddress]
/map/AddNotification.do [devicename]
/map/AddNotification.do [displayName]
/map/AddNotification.do [ipAddress]
/map/AddProcesses.do [deviceName]
/map/AddProcesses.do [displayName]
/map/AddProcesses.do [ipAddress]
/map/AddServices.do [devicename]
/map/AddServices.do [devicename]
/map/AddServices.do [devicename]
/map/EditMap.do [source]
/map/FileMonitorTemplates.do [devicename]
/map/FileMonitorTemplates.do [monitorType]
/map/InvokeDeviceType.do [devicename]
/map/InvokeDeviceType.do [devicename]
/map/InvokeDeviceType.do [devicename]
/map/InvokeMonitoring.do [devicename]
/map/InvokeMonitoring.do [devicename]
/map/MapView.do [displayName]
/map/SnpUpdateServices.do [displayName]
/map/SnpUpdateServices.do [ipAddress]
/map/UpdateDeviceType.do [devicename]
/modifyDashboard.do [dashboardName]
/reports/Availability.do [bview]
/reports/Availability.do [reportGroup]
/reports/Availability.do [reportGroup]
/reports/Availability.do [reportGroup]
/reports/Availability.do [reportGroup]
/reports/Availability.do [reportGroup]
/reports/Availability.do [viewCount]
/reports/NewReport.do [repName]
/reports/NewReport.do [repName]
/reports/NewReport.do [repName]
/reports/NewReport.do [repName]
/reports/deviceAvailability.do [deviceName]
/reports/deviceAvailability.do [deviceName]
/reports/deviceAvailability.do [deviceName]
/reports/deviceAvailability.do [deviceName]
/webclient/admin/jsp/DeviceQuery.jsp [oidtext]


Vulnerable to CSRF:
/SavePreferences.do
/TabMenu.do
/admin/AddCriteria.do
/admin/AddIPSLAMonitor.do
/admin/BenchmarkDataUpload.do
/admin/BulkDeviceAssociation.do
/admin/BulkEditDeviceGraph.do
/admin/CategoryOperation.do
/admin/ConfigureProfile.do
/admin/DBManagement.do
/admin/DependencyList.do
/admin/DeviceAssociation.do
/admin/EditInterfaceTemplates.do
/admin/EditInterfaceTemplates1.do
/admin/ImportWorkflow.do
/admin/MaintenanceTask.do
/admin/RebrandOPM.do
/admin/SNMPTrapProcessors.do
/admin/SaveInterfaceTemplates.do
/admin/ScheduleMgmt.do
/admin/ScriptMonitor.do
/admin/ScriptTemplateImport.do
/admin/SelectQCW.do
/admin/ServiceConfiguration.do
/admin/SetupSDesk.do
/admin/ShareTemplate.do
/admin/SysLogNotification.do
/admin/SysLogRules.do
/admin/TrapNotification.do
/admin/UpdateAlarmEscalation.do
/admin/ViewFailoverDetails.do\
/cctvConfig.do
/devices/AddFromCSV.do
/devices/CustomLinks.do
/devices/switchPortMapTool.do
/map/L2Map.do
/map/SnmpDetails.do
/reports/AuditReport.do
/reports/GenerateReports.do
/reports/SelectDevice.do
/reports/deviceAvailability.do
/topo/addNewNetwork.do

Additionally

GET /api/json/device/getDeviceSummary?name=localhost&apiKey=aaaa&_bbbb

:false,"deviceName":"localhost","sysDescr":"","isNetwork":false,"responseTime":"001ms","ipAddress":"127.0.0.1","ramSize":"NA","vendorName":"Unknown","pollUsing":"ICMP","status":"L..schen","community":"public","dnsName":"localhost","availdata":{"Down":0,"Not
Monitored":0,"Up":100,"Parent Down":0,"Dependent Unavailable":0,"On
Hold":0,"On Maintenance":0},"customLinks":[],"isvCenter":false,"isSNMP":false,"snm

This returns the community password for SNMP devices. This can allows someone malicious on the panel or via XSS collect 
SNMP passwords.