Bugtraq mailing list archives
CVE-2018-11552 AXON PBX 2.02 Cross Site Scripting Vulnerability
From: mehta.himanshu21 () gmail com
Date: Wed, 30 May 2018 09:38:54 GMT
Aloha, *1. Introduction* Vendor: NCH Software Affected Product: AXON PBX - 2.02 Vendor Website: http://www.nch.com.au/pbx/index.html Vulnerability Type: Reflected XSS Remote Exploitable: Yes CVE: CVE-2018-11552 *2. Overview* There is a reflected XSS vulnerability in AXON PBX Web interface. The vulnerability exists due to insufficient filtration of user-supplied data. A remote attacker can execute arbitrary HTML and script code in browser in context of the vulnerable application. *3. Affected Parameter* 'Name' Parameter (Go to AXON->Auto-Dialer->Agents->Name) *4. Payload* <script>alert('XSS')</script> *5. Credit* Himanshu Mehta (@LionHeartRoxx) Chao, Himanshu Mehta
Current thread:
- CVE-2018-11552 AXON PBX 2.02 Cross Site Scripting Vulnerability mehta . himanshu21 (Jun 03)