| शीर्षक | Control iD 1.x.x Cross Site Scripting |
|---|
| विवरण | A Stored Cross-Site Scripting (XSS) vulnerability was identified in the user registration functionality of the Control iD system.
To validate the vulnerability, the following servers can be used:
http://x.x.x.x:8085
http://x.x.x.x:8091
http://x.x.x.x:3050
Access the servers using the default credentials "admin:admin".
1. Go to the "Cadastrar" option on the left side of the system.
2. Click on "Usuários".
3. Click on "Adicionar" (highlighted in green).
4. In the "Nome" field, insert the payload: <script>alert('XSS')</script>
5. Access the "Usuários" page again and the payload will be triggered.
As a result, every time the user page is accessed, the payload is executed, confirming a Stored Cross-Site Scripting vulnerability. |
|---|
| स्रोत | ⚠️ https://x.x.x.x:8085/create_objects.fcgi |
|---|
| उपयोगकर्ता | Fr1t0 (UID 82967) |
|---|
| सबमिशन | 31/07/2025 04:58 AM (1 वर्ष पहले) |
|---|
| संयम | 09/08/2025 07:37 AM (9 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 217717 [Control iD Gerencia Web 1.30 Web Interface Nome क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 0 |
|---|