Vulnerability title: Multiple Stored Cross-Site scripting=20
CVE: CVE-2014-3111
Vendor: FOG Project
Product: FOG Imaging system
Affected version: 0.27 =96 0.32(latest)
Fixed version: N/A
Reported by: Dolev Farhi
----------------------------
VULNERABILITY Details:
----------------------------
Latest and earlier versions of fog image deployment system (0.27 through
0.32) are vulnerable to multiple persistent=20
Cross-Site scripting in various resource management pages.
By creating a printer, a new system image or a storage resource with
malicious code e.g. (code) <script>alert(=93sample=94)</script>
it is possible for a malicious user to execute client-side =A0scripts =
once a
user or possibly an admin =A0attempts to load any of the resource =
management
pages.
-------------------------------------
VULNERABLE FOG RESOURCES
-------------------------------------
XSS Vulnerable resources:
1.Printer Management
2.Image Management
3.Storage Management
4.User Cleanup =A0
--------------------------
PROOF OF CONCEPT
--------------------------
https://www.youtube.com/watch?v=3DtFCLDAH35jU