| शीर्षक | BDCOM P3310D Bios version 0.4.2 Firmware 10.1.0F Build 86345 Cross Site Scripting |
|---|
| विवरण | A stored Cross-Site Scripting (XSS) vulnerability was identified in the router BDCOM-OLT
within the Remote Monitor feature (RMON Config → RMON History → New). The application does not properly sanitize input provided in the “Owner” parameter, allowing the injection of a malicious payload such as <img/src/onerror=prompt(8)>. Once submitted, the payload is stored and later executed when the RMON History page is accessed, as demonstrated by the triggered JavaScript prompt. This confirms that user-controlled input is being rendered without proper output encoding, exposing administrators to potential session hijacking, unauthorized actions, or further exploitation. Proper server-side validation and output encoding should be implemented to mitigate this vulnerability.
|
|---|
| स्रोत | ⚠️ http://admin:admin@x.x.x.x:8082/ |
|---|
| उपयोगकर्ता | Havook (UID 71104) |
|---|
| सबमिशन | 04/04/2026 11:05 PM (23 दिन पहले) |
|---|
| संयम | 24/04/2026 09:58 PM (20 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 359556 [BDCOM P3310D 0.4.2 10.1.0F Build 86345 New RMON History Page Owner क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 17 |
|---|