| عنوان | OcoMon Software 4.0 Cross Site Scripting |
|---|
| الوصف | Hi VulDB Team! I found a Reflected XSS via Path Injection in OcoMon 4.0RC1 - 20211023
I checked for CVE assigned for this but I not found and I contacted vendor but no response.
This website for example using the software and it's vulnerable, see the XSS Pop-up:
https://sac.edtbrasil.com/includes/common/require_access_recovery.php/xx'%22%3E%3Cimg%20src=q%20onerror=prompt(document.domain)%3E
I injected the payload: xx'"><img src=q onerror=prompt(document.domain)> in final URL after "/"
Google Dorks for finding more websites:
intitle:"OcoMon 4.0RC1 - 20211023"
intitle:"OcoMon 4.0RC1"
Impact:
View any information that the user is able to view.
Modify any information that the user is able to modify.
Initiate interactions with other application users, including malicious attacks, that will appear to originate from the initial victim user.
Others:
1- Ad-Jacking 2- Session Hijacking 3- Bypassing CSRF protection 4- Phishing
5- Send malware to users 6- Redirect to malicious website
Cheers,
Everton Hydd3n |
|---|
| المصدر | ⚠️ https://sac.edtbrasil.com/includes/common/require_access_recovery.php/xx'%22%3E%3Cimg%20src=q%20onerror=prompt(document.domain)%3E |
|---|
| المستخدم | Hydd3n (UID 73317) |
|---|
| ارسال | 10/08/2024 12:15 PM (2 سنوات منذ) |
|---|
| الاعتدال | 12/08/2024 08:46 PM (2 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 274205 [OcoMon 4.0/4.0RC1/5.0RC1 URL require_access_recovery.php البرمجة عبر المواقع] |
|---|
| النقاط | 20 |
|---|