Join our followers
Cross-Site Scripting (XSS) in Feng Office
| Advisory ID: | HTB23174 |
| Product: | Feng Office |
| Vendor: | Secure Data SRL |
| Vulnerable Versions: | 2.3.2-rc and probably prior |
| Tested Version: | 2.3.2-rc |
| Advisory Publication: | September 18, 2013 [without technical details] |
| Vendor Notification: | September 18, 2013 |
| Public Disclosure: | October 9, 2013 |
| Latest Update: | October 9, 2013 |
| Vulnerability Type: | Cross-Site Scripting [CWE-79] |
| CVE Reference: | CVE-2013-5744 |
| Risk Level: | Medium |
 | |
| CVSSv2 Base Score: | 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N) |
| Solution Status: | Solution Available |
| Discovered and Provided: | High-Tech Bridge Security Research Lab |
| Advisory Details: | |
High-Tech Bridge Security Research Lab discovered vulnerability in Feng Office, which can be exploited to perform Cross-Site Scripting (XSS) attacks against users of vulnerable application. | |
| Solution: | |
| Vendor did not reply to 3 notifications by email, 1 notification by twitter, 1 notification by contact form on website, 1 forum thread, 1 support ticket. Currently we are not aware of any official solution for this vulnerability. Unofficial patch was developed by High-Tech Bridge Security Research Lab and is available here: https://www.immuniweb.com/advisory/HTB23174-patch.zip | |
References: | |
| [1] High-Tech Bridge Advisory HTB23174 - https://www.immuniweb.com/advisory/HTB23174 - Cross-Site Scripting (XSS) in Feng Office. [2] Feng Office - http://www.fengoffice.com - Feng Office is a Web-based Software that integrates Project Management, Client Relationship Management, Billing, Financing, among other features that help you efficiently run your Professional Services Business. [3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures. [4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types. [5] ImmuniWeb® - Leveraging the power of machine-learning and genius of human brain to deliver the most advanced web application security and penetration testing. [6] ImmuniWeb® SSLScan - Test your servers for security and compliance with PCI DSS, HIPAA and NIST. | |
Please feel free to send us any additional information related to this Advisory, such as vulnerable versions, additional exploitation details and conditions, patches and other relevant details.
