| शीर्षक | 合肥屏播网络科技有限公司 GotoHTTP 10.2 xss |
|---|
| विवरण | A reflected Cross-Site Scripting (XSS) vulnerability exists in the /reg.12x endpoint of the GotoHTTP remote control platform. The sn parameter in HTTP GET requests is improperly sanitized and directly echoed back to the client in the error message response without HTML encoding. An unauthenticated attacker can exploit this vulnerability by crafting a malicious URL containing arbitrary JavaScript code in the sn parameter. When a victim clicks the crafted link, the injected script executes in the victim's browser context, potentially leading to session hijacking, credential theft, arbitrary actions performed on behalf of the victim, or information disclosure.
Proof of Concept (PoC):
https://tohttp.com/reg.12x?c=1&sn=%3Cscript%3Ealert(%27xss%27)%3C/script%3E
The JavaScript code alert('xss') is executed in the victim's browser context when the crafted link is clicked. |
|---|
| स्रोत | ⚠️ https://github.com/Qq1111111111/CVE/issues/1 |
|---|
| उपयोगकर्ता | songmaoyang (UID 98606) |
|---|
| सबमिशन | 29/05/2026 05:44 AM (4 महीनों पहले) |
|---|
| संयम | 28/06/2026 11:31 AM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 374544 [GotoHTTP तक 10.2 /reg.12x sn क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|