Document Title:
===============
OpenCATS v0.9.4-3 - Multiple Cross Site Vulnerabilities
References (Source):
====================
https://www.vulnerability-lab.com/get_content.php?id=2232
Release Date:
=============
2020-04-28
Vulnerability Laboratory ID (VL-ID):
====================================
2232
Common Vulnerability Scoring System:
====================================
4
Vulnerability Class:
====================
Cross Site Scripting - Non Persistent
Current Estimated Price:
========================
500€ - 1.000€
Product & Service Introduction:
===============================
The leading free & open applicant tracking system. OpenCATS is a Free and Open Source Candidate/Applicant
Tracking System designed for Recruiters to manage recruiting process from job posting, candidate application, through
to candidate selection and submission.
(Copy of the Homepage: http://www.opencats.org/ & https://github.com/opencats/opencats )
Abstract Advisory Information:
==============================
The vulnerability laboratory core research team discovered multiple client-side xss web vulnerabilities in the OpenCATS v0.9.4 web-application.
Vulnerability Disclosure Timeline:
==================================
2020-04-29: Public Disclosure (Vulnerability Laboratory)
Discovery Status:
=================
Published
Exploitation Technique:
=======================
Remote
Severity Level:
===============
Medium
Authentication Type:
====================
Pre Auth (No Privileges or Session)
User Interaction:
=================
Low User Interaction
Disclosure Type:
================
Full Disclosure
Technical Details & Description:
================================
Multiple non-persistent cross site scripting vulnerabilities has been discovered in the official OpenCATS v0.9.4 web-application.
The vulnerability allows remote attackers to inject own malicious script codes with non-persistent attack vector to compromise
browser to web-application requests from the client-side.
The cross site scripting vulnerabilities are located in the `quickSearchFor`, `advancedSearchParser` and `wildCardString` parameters
of the `index.php` files. The vulnerable modules are Search and Advanced Search. The request method to inject the malicious script
code is GET and the attack vector of the vulnerability is non-persistent on client-side.
Successful exploitation of the vulnerability results in session hijacking, non-persistent phishing attacks, non-persistent external
redirects to malicious source and non-persistent manipulation of affected or connected application modules.
Request Method(s):
[+] GET
Vulnerable File(s):
[+] index.php
Vulnerable Parameter(s):
[+] quickSearchFor
[+] advancedSearchParser
[+] wildCardString
Proof of Concept (PoC):
=======================
The client-side cross site scripting web vulnerabilities can be exploited by remote attackers without user account and with low user interaction.
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.
PoC: Payload
%3E%22%3E%3Ciframe+src%3Devil.source%3E%3Ciframe%3E%3C%2Fiframe%3E%3C%2Fiframe%3E
PoC: Exploitation
OPENCATS XSS POC (Search & Advanced Search - Backend)