| शीर्षक | BDCOM P3310D 0.4.2 10.1.0F Build 86345 Cross Site Scripting |
|---|
| विवरण | A stored Cross-Site Scripting (XSS) vulnerability was identified in the router interface at index.asp
within the User Management functionality (System Mgr → User Mgr → New). The application fails to properly sanitize input provided in the “User name” parameter, allowing an attacker to inject a malicious payload (e.g., <script>alert(1)</script>) when creating a new user. This payload is then stored and executed whenever the affected page is accessed, as demonstrated by the JavaScript alert being triggered in the administrator’s browser. This indicates improper input validation and output encoding, potentially enabling session hijacking, privilege escalation, or unauthorized actions. It is recommended to implement strict server-side validation and proper output encoding to prevent script execution.
|
|---|
| स्रोत | ⚠️ http://admin:admin@x.x.x.x:8082/ |
|---|
| उपयोगकर्ता | Havook (UID 71104) |
|---|
| सबमिशन | 04/04/2026 10:35 PM (6 महीनों पहले) |
|---|
| संयम | 24/04/2026 09:58 PM (20 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 359554 [BDCOM P3310D 0.4.2 10.1.0F Build 86345 New User Page /index.asp User name क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 17 |
|---|