Full Disclosure mailing list archives
CVE-2018-11552 AXON PBX 2.02 Cross Site Scripting
From: Himanshu Mehta <mehta.himanshu21 () gmail com>
Date: Wed, 30 May 2018 15:08:06 +0530
Aloha, *1. Introduction* Vendor: NCH Software Affected Product: AXON PBX - 2.02 Vendor Website: http://www.nch.com.au/pbx/index.html Vulnerability Type: Reflected XSS Remote Exploitable: Yes CVE ID: CVE-2018-11552 *2. Overview* There is a reflected XSS vulnerability in AXON PBX Web interface. The vulnerability exists due to insufficient filtration of user-supplied data. A remote attacker can execute arbitrary HTML and script code in browser in context of the vulnerable application. *3. Affected Parameter* 'Name' Parameter (Go to AXON->Auto-Dialer->Agents->Name) *4. Payload* <script>alert('XSS')</script> *5. Credit* Himanshu Mehta (@LionHeartRoxx) Chao, Himanshu Mehta _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Current thread:
- CVE-2018-11552 AXON PBX 2.02 Cross Site Scripting Himanshu Mehta (May 30)