Serena Business Manager < 10.01 DOM XSS Vulnerability

[Cosmin Maier <cosmin () zeroday pro>]

> > # Exploit Title: Serena Business Manager < 10.01 DOM XSS Vulnerability
> > # Date: 11-feb-16
> > # Exploit Author: Zeroday.pro Labs
> > # Software Link: https://www.serena.com/index.php/en/products/it-process-portal-management/sbm/overview/
> > # Version: Tested and working on 10.01.04.01.1068 (build 10)
> > Serena Business Manager is vulnerable to a DOM cross-site scripting (XSS) attack. The attack allows execution of 
> > arbitrary JavaScript in the context of the user’s browser.
> > Vulnerability resides in source location.href at tmtrack.dll and sink jQuery.html   
> >  
> > Example:
> > The SBM User Workspace cannot be embedded in another frame.<br><a href=http://link/tmtrack/tmtrack.dll 
> > target=_new>1337</a>
> >  

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/