Eventum 2.3.1 stored XSS

vendor:

Eventum

by:

Saif El-Sherei

7.5

CVSS

HIGH

Stored XSS

CWE

Product Name: Eventum

Affected Version From: 2.3.2001

Affected Version To: 2.3.2001

Patch Exists: YES

Related CWE: N/A

CPE: 2.3.2001

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: FF 3.0.15, IE 8

2011

Eventum is a user-friendly and flexible issue tracking system that can be used by a support department to track incoming technical support requests, or by a software development team to quickly organize tasks and bugs. The 'Full-Name' variable is not properly sanitized before displayed in any page. where an authorized user can perform this attack on other users who has access to the system, by changing his own 'full-name' in the preferences section.

Mitigation:

Input validation and output encoding should be used to prevent XSS attacks.

Source

Exploit-DB raw data:

# Exploit Title: Eventum 2.3.1 stored XSS
# Date: 19-2-2011
# Author: Saif El-Sherei
# Software Link: https://code.launchpad.net/eventum
# Version: Eventum 2.3.1
# Tested on: FF 3.0.15, IE 8
# Vendor notification: vendor notified, awaiting response
 
Info:

Eventum is a user-friendly and flexible issue tracking system that can be used by a support department to track incoming technical support requests, or by a software development team to quickly organize tasks and bugs. 
 
Details:

The "Full-Name" variable is not properly sanitized before displayed in any page. where an authorized user can perform this attack on other users who has access to the system, by changing his own "full-name" in the preferences section.
 
POC:

<script>alert('w00t');</script>