Classification: NON SENSITIVE INFORMATION RELEASABLE TO THE PUBLIC
Multiple vulnerabilities in BMC SERVICE DESK EXPRESS (SDE) Version
10.2.1.95
=20
Affected Product:
BMC SERVICE DESK EXPRESS (SDE) Version 10.2.1.95
Timeline:
07 June 2013 - Vulnerability found
12 June 2013 - Vendor informed
17 June 2013 - Vendor replied/confirmed & opened service ticket
=20
Credits:
Nuri Fattah of NATO / NCIRC (www.ncirc.nato.int)
=20
CVE: To be assigned
=20
NCIRC ID: NCIRC-2013127-02
=20
Description:
Multiple vulnerabilities, including Cross-Site Scripting(XSS) and SQL
injection were identified in the latest version of BMC SERVICE DESK
EXPRESS
=20
Vulnerability Details:
1. SQL injection
a. /SDE/DashBoardGUI.aspx=20
vuln parameter: [ASPSESSIONIDASSRATTQ cookie]
b. /SDE/DashBoardGUI.aspx=20
vuln parameter: [TABLE_WIDGET_1 cookie]
c. /SDE/DashBoardGUI.aspx=20
vuln parameter: [TABLE_WIDGET_2 cookie]
d. SDE/DashBoardGUI.aspx=20
vuln parameter: [browserDateTimeInfo cookie]
e. /SDE/DashBoardGUI.aspx=20
vuln parameter: [browserNumberInfo cookie]
f. /SDE/login.aspx=20
vuln parameter: [UID]
=20
2. Reflected XSS
a. /SDE/QV_admin.aspx=20
vuln parameter: [SelTab]
b. /SDE/QV_grid.aspx=20
vuln parameter: [CallBack]
c. /SDE/commonhelp.aspx=20
vuln parameter: [HelpPage]
example:
GET
/SDE/QV_grid.aspx?QuerySeq=3D1068&CondVal=3D1%40V1%40ADMINISTRATION%401&C=
all
Back=3Dparent.parent.frames.TmInputs.callBack(doGridDataCallBack.argument=
s
[0]);</script><script>alert(99817)</script>&ViewType=3Dg&bRefresh=3D
HTTP/1.1
=20
Solution:
No Solution has yet been provided.
Please contact the vendor.=20