eFront 3.6.14.4 - 'surname' Persistent Cross-Site Scripting

Author: shyamkumar somana
type: webapps
platform: php
port: 80.0
date_added: 2014-06-09 
date_updated: 2014-06-09 
verified: 0 
codes: OSVDB-107816;CVE-2014-4033 
tags: 
aliases:  
screenshot_url:  
application_url: http://www.exploit-db.comefront_open_source-master.zip

# Exploit Title: Persistent Cross Site Scripting Vulnerability in eFront
3.6.14.4
# Date: 05 June 2014
# Exploit Author: shyamkumar somana
# Vendor Homepage: http://www.efrontlearning.net
# Software Link:
https://sourceforge.net/projects/efrontlearning/files/latest/download
# Version: 3.6.14.4
# Tested on: Windows 7

#################################################
eFront 3.6.14.4 is vulnerable for a Persistent Cross Site Scripting
Vulnerability.
The vulnerability affects 'surname' parameter(Last Name Field) while
updating the account details.

Vendor has supplied a workaround for the vulnerability which can be found
at

https://github.com/epignosis/efront_open_source/issues/5

#################################################
Greetz : oldmanlab, Jinen Patel