SAP Crystal Reports Server Multiple Vulnerabilities.
Crystal Reports Server 2008
Multiple vulnerabilities in SAP Crystal Reports Server 2008, which can be exploited by malicious users to disclose potentially sensitive information and by malicious people to conduct cross-site scripting attacks, manipulate certain data, and compromise a user's system.
1) Input passed to the "actId" parameter in InfoViewApp/jsp/common/actionNav.jsp, "backUrl" parameter in InfoViewApp/jsp/common/error.jsp, and "logonAction" parameter in InfoViewApp/logon.jsp is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
2) An insecure "CreateTextFile()" method in an ActiveX control (scriptinghelpers.dll) can be exploited to overwrite existing files.
3) An insecure "LaunchProgram()" method in an ActiveX control (scriptinghelpers.dll) can be exploited to execute an arbitrary program.
4) An insecure "DeleteFile()" method in an ActiveX control (scriptinghelpers.dll) can be exploited to delete an arbitrary file.
5) An insecure "Kill()" method in an ActiveX control (scriptinghelpers.dll) can be exploited to terminate a running process.
Successful exploitation of this vulnerability requires knowing a valid process id.
6) Input passed to the "path" parameter in PerformanceManagement/jsp/qa.jsp (when "func" is set to "browse" and "root" is set to "wi") is not properly verified before being used to read files. This can be exploited to display arbitrary files from local resources via directory traversal attacks.
Successful exploitation of this vulnerability requires valid credentials.
Vulnerability Report: Crystal Reports Server 2008
This vulnerability report for Crystal Reports Server 2008 contains a complete overview of all Secunia advisories affecting it. SAP client can use this vulnerability report to ensure that you are aware of all vulnerabilities, both patched and unpatched, affecting this product allowing you to take the necessary precautions.
SAP Client Support