Two XSS Vulnerabilities in SupportCenter Plus

High-Tech Bridge Security Research Lab discovered two XSS vulnerabilities in a web-based customer support software SupportCenter Plus. These vulnerabilities can be exploited to perform Cross-Site Scripting attacks against authenticated users of the vulnerable software.


1) Cross-Site Scripting (XSS) in SupportCenter Plus: CVE-2015-0866

The discovered XSS vulnerabilities can be used by attackers to steal cookies or other sensitive user data of a vulnerable website.

Attackers can also perform more sophisticated attacks, such as spear phishing, or launch drive-by-download attacks against website users by injecting malware or exploit-packs into vulnerable scripts.

1.1 Input passed via the "fromCustomer" HTTP GET parameter to "/HomePage.do" script is not properly sanitised before being returned to the user. A remote attacker can trick a logged-in user to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.

A simple exploit below uses the "alert()" JavaScript function to display "ImmuniWeb" word:

http://[host]/HomePage.do?fromCustomer=customerportal_%3C/script%3E%3Cscript %3Ealert%28/ImmuniWeb/%29%3C/script%3E

1.2 Input passed via the "username" and "password" HTTP POST parameters to "/HomePage.do" script are not properly sanitised before being returned to the user. A remote attacker can trick a logged-in user to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.

Below is a simple exploit that can be used to demonstrate the vulnerability. After submitting the form two JavaScript dialog boxes will appear with "ImmuniWeb" word:

<form action="http://[host]/HomePage.do" method="post" name="main">
<input type="hidden" name="username" value='</script><script>alert(/ImmuniWeb/)</script>'>
<input type="hidden" name="password" value='</script><script>alert(/ImmuniWeb/)</script>'>
<input type="submit" id="btn">
</form>