[prev in list] [next in list] [prev in thread] [next in thread] 

List:       full-disclosure
Subject:    [FD] CVE-2018-11552 AXON PBX 2.02 Cross Site Scripting
From:       Himanshu Mehta <mehta.himanshu21 () gmail ! com>
Date:       2018-05-30 9:50:06
Message-ID: CAAYZd=kPWGmQRGq4g+03XS0-UnoSD-xXn-A8xb3HUXbx=MQDBw () mail ! gmail ! com
[Download RAW message or body]

Aloha,

*1. Introduction*

Vendor:                NCH Software
Affected Product:      AXON PBX - 2.02
Vendor Website:        http://www.nch.com.au/pbx/index.html
Vulnerability Type:    Reflected XSS
Remote Exploitable:    Yes
CVE ID:                   CVE-2018-11552

*2. Overview*

There is a reflected XSS vulnerability in AXON PBX Web interface. The
vulnerability exists due to insufficient filtration of user-supplied data.
A remote attacker can execute arbitrary HTML and script code in browser in
context of the vulnerable application.

*3. Affected Parameter*
'Name' Parameter (Go to AXON->Auto-Dialer->Agents->Name)

*4. Payload*
<script>alert('XSS')</script>


*5. Credit*
Himanshu Mehta (@LionHeartRoxx)

Chao,

Himanshu Mehta

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/
[prev in list] [next in list] [prev in thread] [next in thread]