bugtraq - CVE-2018-11552 AXON PBX 2.02 Cross Site Scripting Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <201805300938.w4U9csPC017108@ip-100-122-159-248.us-east-1.ec2.aws.symcpe.net>
Date: Wed, 30 May 2018 09:38:54 GMT
From: mehta.himanshu21@...il.com
To: bugtraq@...urityfocus.com
Subject: CVE-2018-11552 AXON PBX 2.02 Cross Site Scripting Vulnerability

Aloha,

*1. Introduction*

Vendor:                NCH Software
Affected Product:      AXON PBX - 2.02
Vendor Website:        http://www.nch.com.au/pbx/index.html
Vulnerability Type:    Reflected XSS
Remote Exploitable:    Yes
CVE:                   CVE-2018-11552

*2. Overview*

There is a reflected XSS vulnerability in AXON PBX Web interface. The
vulnerability exists due to insufficient filtration of user-supplied data.
A remote attacker can execute arbitrary HTML and script code in browser in
context of the vulnerable application.

*3. Affected Parameter*
'Name' Parameter (Go to AXON->Auto-Dialer->Agents->Name)

*4. Payload*
<script>alert('XSS')</script>

*5. Credit*
Himanshu Mehta (@LionHeartRoxx)

Chao,

Himanshu Mehta