Full Disclosure mailing list archives
CVE-2019-9955 Refelected XSS on Zyxel Login page
From: aaron bishop <abishop () linux com>
Date: Mon, 15 Apr 2019 12:26:58 -0600
Numerous Zyxel devices are vulnerable to a reflected XSS issue on the login page. The mp_idx parameter is included in the page unsanitized. A request such a https://$RHOST/?mobile=1&mp_idx=%22;alert(1);// Will trigger an alert, demonstrating the issue. A call to getScript() can be used to include a full external JavaScript file to capture the credentials of the user. Disclosure at: https://www.securitymetrics.com/blog/Zyxel-Devices-Vulnerable-Cross-Site-Scripting-Login-page _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Current thread:
- CVE-2019-9955 Refelected XSS on Zyxel Login page aaron bishop (Apr 16)