Full Disclosure mailing list archives
CVE-2014-3740 - SpiceWorks Cross-site scripting
From: Dolev Farhi <dolev () openflare org>
Date: Sat, 07 Jun 2014 08:49:02 +0300
|Exploit Title: Multiple Stored XSS vulnerabilities in SpiceWorks Ticketing system
CVE: CVE-2014-3740 Vendor: SpiceWorks Product: SpiceWorks IT ticketing system Affected versions: any version below||7.2.00195 Fixed version: 7.2.00195 ||| |1. About the application:| |=======================||||SpiceWorks is an IT ticketing system deployed in many companies around the world|
|| |2. Details| |===========||Multiple stored XSS were found in SpiceWorks system, allowing an attacker to create a SpiceWorks IT ticket with malicious code.| |once an admin attemps to login to the system dashboard to view open tickets, the code executes and the attacker|
|could potentially steal the admin's cookies.| 3. Timeline: ============= 12.5.2014 - Vulnerability discovered 12.5.2014 - Vendor notified 13.5.2014 - CVE Requested 15.5.2014 - CVE Assigned (CVE-2014-3740)02.6.2014 - SpiceWorks fixed the problem in the latest version of 7.2 (7.2.00195)
07.6.2014 - Full disclosure released | 4. Proof of concept: =================== ||||i. Create a ticket in user_portal with the title <script>alert(document.cookie);</script>|
|||ii. submit.||||iii. login as admin user and navigate to the open tickets, the XSS appears.
* A Proof of concept video can also be found here: Link <http://research.openflare.org/poc/OF-2014-07/spiceworks_crafted_ticket.mp4>
| || _______________________________________________ Sent through the Full Disclosure mailing list http://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Current thread:
- CVE-2014-3740 - SpiceWorks Cross-site scripting Dolev Farhi (Jun 08)