Xplico v0.5.7 (add.ctp) Remote XSS Vulnerability 
  
Title: Xplico v0.5.7 (add.ctp) Remote XSS Vulnerability 
Type: Remote 
Impact: Cross-Site Scripting 
Release Date: 02.07.2010 
Release mode: Coordinated release 
  
  
Summary 
======= 
  
The goal of Xplico is extract from an internet traffic capture the applications 
data contained. For example, from a pcap file Xplico extracts each email (POP, IMAP, 
and SMTP protocols), all HTTP contents, each VoIP call (SIP), FTP, TFTP, and so on. 
Xplico isn’t a network protocol analyzer. Xplico is an open source Network Forensic 
Analysis Tool (NFAT). 
  
  
  
Description 
=========== 
  
Xplico is vulnerable to Cross-Site Scripting vulnerability. An attacker can use the 
\\\"POST\\\" to take advantage of this vulnerability, injecting code into the web pages 
viewed by other users. 
  
  
  
-------------------------------------------------------------------------------- 
  
Detecting vulnerabilities 
- /opt/xplico/xi/app/views/pols/add.ctp:13 
- /opt/xplico/xi/app/views/pols/add.ctp:14 
- /opt/xplico/xi/app/views/sols/add.ctp:10 
  
-------------------------------------------------------------------------------- 
  
  
  
Vendor 
====== 
  
Xplico Team - http://www.xplico.org 
  
  
  
Affected Version 
================ 
  
0.5.7 
  
  
PoC 
=== 
  
- /opt/xplico/xi/app/views/pols/add.ctp:13 
echo $form->input(\\\'Pol.name\\\',  array(\\\'maxlength\\\'=> 50, \\\'size\\\' => \\\'50\\\',\\\'label\\\' => \\\'Case 
name            \\\')); 
  
  
Attack: Case name=[XSS] (POST) 
  
  
Credits 
======= 
  
Vulnerability discovered by Marcos Garcia (@artsweb) and Maximiliano Soler (@maxisoler). 
  
  
Solution 
======== 
  
Upgrade to Xplico v0.5.8 (http://sourceforge.net/projects/xplico/files/) 
  
  
Vendor Status 
============= 
[22.06.2010] Vulnerability discovered. 
[22.06.2010] Vendor informed. 
[22.06.2010] Vendor replied. 
[24.06.2010] Asked vendor for confirmation. 
[24.06.2010] Vendor confirms vulnerability. 
[24.06.2010] Asked vendor for status. 
[24.06.2010] Vendor replied. 
[29.06.2010] Vendor reveals patch release date. 
[29.06.2010] Coordinated public advisory. 
  
  
References 
========== 
  
[1] http://www.xplico.org/archives/710 
  
  
Changelog 
========= 
  
[02.07.2010] - Initial release 
  
  
Web: http://www.zeroscience.mk 
e-mail: