Reflected cross-site scripting(XSS) Vulnerability in Manage Engine AD Audit Manager Plus Admin Panel(Build 6270)

[harish.ramadoss@xxxxxxxxxx]

#####################################
Title:- Reflected cross-site scripting(XSS) Vulnerability in Manage Engine AD 
Audit Manager Plus Admin Panel(Build 6270) 
Author: Harish Ramadoss - Help AG Middle East
Vendor: ZOHO Corp
Product: Manage Engine AD Audit Manager Plus
Version: All versions below Build 6270 are mostly affected
Tested Version: Build 6270
Severity: Medium
CVE Reference: CVE-2015-1026

# About the Product:
ADManager Plus is a Windows Active Directory Management and Reporting Solution 
that helps AD Administrators and Help Desk Technicians with their day-to-day 
activities. The software handles a variety of complex tasks like Bulk 
Management of User accounts and other AD objects, Delegate Role based access to 
Help Desk Technicians, and generates an exhaustive list of AD Reports,

# Description:
An attacker may leverage this issue to execute arbitrary script code in the 
browser of an unsuspecting user in the context of the affected site. This can 
allow the attacker to steal cookie-based authentication credentials and launch 
other attacks. This leads to compromising the whole domain as the application 
normally uses privileged domain account to perform administration tasks.


# Vulnerability Class:
Reflected cross-site scripting(XSS) - 
hhttps://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29

# How to Reproduce: (POC):

1. ?technicianSearchText? parameter is vulnerable to XSS on ?Help Desk 
Technician? page. The page can be found at : AD Delegation -> Help Desk 
Technician
2. "rolesSearchText" parameter is vulnerable to XSS on ?Help Desk Roles? page. 
The page can be found at : AD Delegation -> Help Desk Roles
 
Proof of Concept code to test XSS : <b onmouseover=alert(document.cookie)>Hover 
over me!</b>

# Disclosure:
Discovered: December 08, 2014
Vendor Notification: Jan 22, 2015
Public Disclosure: Mar 10, 2015

# Affected Targets:
All versions below Build 6270 are mostly affected. On all platforms (Actually 
platform doesn't affect the issue).


# credits:
Harish Ramadoss
Information Security Analyst
Help AG Middle East

#References:
[1] help AG middle East http://www.helpag.com/.
[2] https://www.manageengine.com/products/ad-manager/
[4] https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29(XSS)
[5] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - 
international in scope and free for public use, CVE® is a dictionary of 
publicly known information security vulnerabilities and exposures.