# Exploit Title: Serena Business Manager < 10.01 DOM XSS Vulnerability
# Date: 11-feb-16
# Exploit Author: Zeroday.pro Labs
# Software Link: https://www.serena.com/index.php/en/products/it-process-portal-management/sbm/overview/
# Version: Tested and working on 10.01.04.01.1068 (build 10)
Serena Business Manager is vulnerable to a DOM cross-site scripting (XSS) attack. The attack allows execution of arbitrary JavaScript in the context of the user’s browser.
Vulnerability resides in source location.href at tmtrack.dll and sink jQuery.html   
 
Example:
The SBM User Workspace cannot be embedded in another frame.<br><a href=http://link/tmtrack/tmtrack.dll target=_new>1337</a>