{"id":16679,"date":"2021-07-08T11:55:04","date_gmt":"2021-07-08T09:55:04","guid":{"rendered":"https:\/\/herolab-usd.formwandler.rocks\/security-advisories\/usd-2020-0029\/"},"modified":"2024-06-24T16:25:23","modified_gmt":"2024-06-24T14:25:23","slug":"usd-2020-0029","status":"publish","type":"page","link":"https:\/\/herolab.usd.de\/en\/security-advisories\/usd-2020-0029\/","title":{"rendered":"usd-2020-0029"},"content":{"rendered":"

[et_pb_section fb_built=\"1\" _builder_version=\"4.16\" _module_preset=\"default\" background_color=\"#2E353D\" custom_padding=\"||0px|||\" global_colors_info=\"{}\"][et_pb_row _builder_version=\"4.16\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_column type=\"4_4\" _builder_version=\"4.16\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_text _builder_version=\"4.25.2\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\" hover_enabled=\"0\" global_colors_info=\"{}\" sticky_enabled=\"0\"]<\/p>\n

usd-2020-0029 | NeoPost Mail Accounting Software Pro 5.0.6<\/span><\/h1>\n

Advisory ID<\/strong>: usd-2020-0029
CVE Number<\/strong>: CVE-2020-27974
Affected Product<\/strong>: NeoPost Mail Accounting Software Pro
Affected Version<\/strong>: 5.0.6
Vulnerability Type<\/strong>: Reflected XSS
Security Risk<\/strong>: High
Vendor URL<\/strong>: https:\/\/www.neopost.de\/<\/a>
Vendor Status<\/strong>: Not fixed<\/p>\n

<\/h3>\n

Description<\/h3>\n

Reflected XSS attack (or non-persistent attack) occurs when a malicious script is reflected off of a web application to the victims browser. The attack is typically delivered via email or a web site and activated through a link, which sends a request to a website with a vulnerability that enables execution of malicious scripts.<\/span><\/p>\n

<\/span><\/p>\n

Proof of Concept (PoC)<\/h3>\n

The XSS attack was possible via the following url: <\/span>http:\/\/localhost\/php\/Commun\/FUS_SCM_BlockStart.php?code=%3Cscript%3Ealert(%27XSS%27)%3C\/script%3E<\/code><\/p>\n

[\/et_pb_text][et_pb_text _builder_version=\"4.16\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\" global_colors_info=\"{}\"]<\/p>\n

\n
\n

Fix<\/h3>\n

Make sure to encode and\/or filter the user supplied input.<\/span><\/p>\n

<\/h3>\n

Timeline<\/h3>\n
    \n
  • 020-03-25 This vulnerability was found during a Penetration Test on one of our customers<\/li>\n
  • 2020-03-26 First attempt to contact vendor<\/li>\n
  • 2020-05-14 Second attempt to contact vendor<\/li>\n
  • 2020-08-06 Third attempt to contact vendor<\/li>\n
  • 2020-09-23 Vendor was informed of upcoming release<\/li>\n
  • 2020-10-27 Security Advisory released<\/li>\n<\/ul>\n

    <\/h3>\n

    Credits<\/h3>\n

    This security vulnerability was found by Tim Kranz and Lars Neumann of usd AG.<\/span><\/p>\n<\/div>\n<\/div>\n

    [\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"

    usd-2020-0029 | NeoPost Mail Accounting Software Pro 5.0.6 Advisory ID: usd-2020-0029CVE Number: CVE-2020-27974Affected Product: NeoPost Mail Accounting Software ProAffected Version: 5.0.6Vulnerability Type: Reflected XSSSecurity Risk: HighVendor URL: https:\/\/www.neopost.de\/Vendor Status: Not fixed Description Reflected XSS attack (or non-persistent attack) occurs when a malicious script is reflected off of a web application to the victims browser. The […]<\/p>\n","protected":false},"author":96,"featured_media":0,"parent":16124,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"class_list":["post-16679","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16679","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/users\/96"}],"replies":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/comments?post=16679"}],"version-history":[{"count":1,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16679\/revisions"}],"predecessor-version":[{"id":22788,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16679\/revisions\/22788"}],"up":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16124"}],"wp:attachment":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/media?parent=16679"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}