Microsoft SharePoint Server 2007 cross site scripting

CVE	Category	Price	Severity
CVE-2009-1734	CWE-79	N/A	High

Author	Risk	Exploitation Type	Date
N/A	High	Remote	2010-04-30

Our sensors found this exploit at: http://cxsecurity.com/ascii/WLB-2010040207

Below is a copy:

Vulnerability ID: HTB22350
Reference: http://www.htbridge.ch/advisory/xss_in_microsoft_sharepoint_server_2007.html
Product: Microsoft SharePoint Server 2007
Vendor: Microsoft Corporation
Vulnerable Version: 12.0.0.6421 and Probably Prior Versions
Vendor Notification: 12 April 2010 
Vulnerability Type: XSS (Ð¡ross Site SÑ�iÑ�ing)
Status: Not Fixed, Vendor Alerted, Awaiting Vendor Response
Risk level: Medium 
Credit: High-Tech Bridge SA (http://www.htbridge.ch/) 

Vulnerability Details:
User can execute arbitrary JavaScript code within the vulnerable application. 

The vulnerability exists due to failure in the "/_layouts/help.aspx" script to properly sanitize user-supplied input in "cid0" variable. Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.

An attacker can use browser to exploit this vulnerability. The following PoC is available: 


http://host/_layouts/help.aspx?cid0=MS.WSS.manifest.xml%00%3Cscript%3Ealert%28%27XSS%27%29%3C/script%3E&tid=X

This information is provided for TESTING and LEGAL RESEARCH purposes only.
All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use and Privacy Policy and Impressum