lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 30 May 2018 15:08:06 +0530
From: Himanshu Mehta <>
Cc: "mehta.himanshu21" <>
Subject: [FD] CVE-2018-11552 AXON PBX 2.02 Cross Site Scripting


*1. Introduction*

Vendor:                NCH Software
Affected Product:      AXON PBX - 2.02
Vendor Website:
Vulnerability Type:    Reflected XSS
Remote Exploitable:    Yes
CVE ID:                   CVE-2018-11552

*2. Overview*

There is a reflected XSS vulnerability in AXON PBX Web interface. The
vulnerability exists due to insufficient filtration of user-supplied data.
A remote attacker can execute arbitrary HTML and script code in browser in
context of the vulnerable application.

*3. Affected Parameter*
'Name' Parameter (Go to AXON->Auto-Dialer->Agents->Name)

*4. Payload*

*5. Credit*
Himanshu Mehta (@LionHeartRoxx)


Himanshu Mehta

Sent through the Full Disclosure mailing list
Web Archives & RSS:

Powered by blists - more mailing lists