| शीर्षक | demtec.sk Graphlytics 5.0.7 Cross Site Scripting |
|---|
| विवरण | [ Reflected XSS on Graphytics v5.0.7 ]
Graphytics version 5.0.7 is vulnerable to Reflected Cross-Site Scripting (XSS), allowing attackers to execute malicious JavaScript in a victim’s browser. This can lead to session hijacking, as the application does not enforce the HttpOnly flag on session cookies, making them accessible to client-side scripts. Exploiting this vulnerability could result in unauthorized access to user sessions and sensitive information.
The issue was tested in the Dockerized version of Graphytics, following the installation guide provided at: https://graphlytic.com/doc/latest/Install_with_Docker_on_Ubuntu.html
Payload used:
http://{graphlytic-ip}:8080/visualization?name`;alert(document.cookie);`=1
Refer complete POC published on the Git repo.
Note:
If possible please add Adamya Varma ([email protected]) as co-researcher for the vulnerability |
|---|
| स्रोत | ⚠️ https://github.com/HexC0d3/graphlytic-xss-exploits/blob/main/reflected_xss.md |
|---|
| उपयोगकर्ता | 0xc0de (UID 83444) |
|---|
| सबमिशन | 04/04/2025 09:15 AM (2 साल पहले) |
|---|
| संयम | 14/04/2025 11:17 PM (11 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 304671 [Demtec Graphytics 5.0.7 HTTP GET Parameter /visualization क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|