[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[FD] CVE-2018-11552 AXON PBX 2.02 Cross Site Scripting
- To: fulldisclosure@xxxxxxxxxxxx, vuln@xxxxxxxxxxx, bugs@xxxxxxxxxxxxxxxxxxx, submissions@xxxxxxxxxxxxxxxxxxxxxxx, bugtraq@xxxxxxxxxxxxxxxxx, oss-security@xxxxxxxxxxxxxxxxxx
- Subject: [FD] CVE-2018-11552 AXON PBX 2.02 Cross Site Scripting
- From: Himanshu Mehta <mehta.himanshu21@xxxxxxxxx>
- Date: Wed, 30 May 2018 15:08:06 +0530
Aloha,
*1. Introduction*
Vendor: NCH Software
Affected Product: AXON PBX - 2.02
Vendor Website: http://www.nch.com.au/pbx/index.html
Vulnerability Type: Reflected XSS
Remote Exploitable: Yes
CVE ID: CVE-2018-11552
*2. Overview*
There is a reflected XSS vulnerability in AXON PBX Web interface. The
vulnerability exists due to insufficient filtration of user-supplied data.
A remote attacker can execute arbitrary HTML and script code in browser in
context of the vulnerable application.
*3. Affected Parameter*
'Name' Parameter (Go to AXON->Auto-Dialer->Agents->Name)
*4. Payload*
<script>alert('XSS')</script>
*5. Credit*
Himanshu Mehta (@LionHeartRoxx)
Chao,
Himanshu Mehta
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/