Openbiz Cubi Cross Site Scripting

Openbiz Cubi Cross Site Scripting

Openbiz Cubi - Multiple XSS
Advisory ID: Openbiz Cubi Cross Site Scripting

Openbiz Cubi - Multiple XSS
Advisory ID: RO-14-010
Severity: Medium
Vendor: Openbiz
Product: Openbiz Cubi
Version: *


Overview #

Multiple Cross-site Scripting (XSS) vulnerabilities exist in Openbiz Cubi. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML.


Vulnerability Details #

Affected Versions: All versions

Root Cause: Insufficient input validation and output encoding on multiple parameters allows XSS attacks.


Exploitation Requirements #

No authentication required for some vectors
Victim must visit crafted URLs or pages

Impact #

Remote attackers can exploit these vulnerabilities to:

Steal user session cookies
Perform actions on behalf of victims
Redirect users to malicious websites

Proof of Concept #

Details available upon request.


Solution #

Apply vendor patches or implement proper input sanitization and output encoding.


References #

Vendor notification sent

Timeline:

[2014-01-01] - Discovered

Credits: Omar Kurt