0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
JExperts Tecnologia / Channel Software Multiple Vulnerabilities
Author
Risk
[Security Risk High
]0day-ID
Category
Date add
CVE
Platform
CVE-2014-8558 - JExperts Tecnologia / Channel Software Escalation Access
Issues
Vendor Notified: 2014-10-27
INTRODUCTION:
The Channel Platform is an enterprise software project management (or
project management) developed by Brazilian company JExperts Technology and
present at thousands clients private enterprise and government enterprise.
This software consists of an integrated set of solutions in the areas of
strategy, projects and processes.
This problem was confirmed in the following versions of the Channel, other
versions maybe also affected.
Version: 5.0.33_CCB
DETAILS:
The Channel software is affected by Escalation Access. The variables
"action" and "key" can be manipulate by the GET method (passing parameters
at the URL itself), where a user, with restricted access, such as "read
only", can realize access to any other request of the call center of a user
other than him and even create or edit existing content posted of other
users.
A logged with any user at the system, just change the parameter of the
action ("action" variable) and the value of the key ("key" variable) to be
manipulated to get unauthorized access to the areas of others users.
Examples:
[1] set action to "acompanhar" and key to "201"
http://<server>/channel/ticket.do?action=acompanhar&key=201
[2] set action to "editar" and key to "100"
http://<server>/channel/ticket.do?action=editar&key=100
CVE-2014-8557 - JExperts Tecnologia / Channel Software Cross Site Scripting
Issues
Vendor Notified: 2014-10-27
INTRODUCTION:
The Channel Platform is an enterprise software project management (or
project management) developed by Brazilian company
JExperts Technology and present at thousands clients private enterprise and
government enterprise. This software consists of an integrated set of
solutions in the areas of strategy, projects and processes.
This problem was confirmed in the following versions of the Channel, other
versions maybe also affected.
Version: 5.0.33_CCB
DETAILS:
The Channel software is affected by Multiple Stored Cross Site Scripting.
The variable "usuario.nome" in page
".../channel/usuario.do?action=editarUsuario&id=XXX", accessible in menu
"Ferramentas" and submenu "alterar dados pessoais", and the variable
"titulo.form" in page "...channel/ticket.do?action=novoChamado", accessible
in menu "[incluir solicitação...]" do not sanitize input data, allowing
attacker to store malicious javascript code in a page.
# 0day.today [2024-11-16] #