| 제목 | Genexis Tilgin Home Gateway 322_AS0500-03_05_13_05 Injection |
|---|
| 설명 | Description:
Stored XSS, also known as persistent XSS, occurs when a malicious script is injected directly into a web application's stored data (e.g., database, file system). This type of XSS is especially dangerous because the malicious script is served to any user who accesses the affected page. The attacker typically exploits a vulnerable input field (such as a comment section or profile field) to store their script. When other users visit the page where the script is stored, it executes in their browser as if it was legitimate content from the web application, leading to potential data theft, session hijacking, or other malicious activities.
#Steps to Reproduce
1). Login to - http://IP/vood/cgi-bin/vood_view.cgi?act=index&lang=EN#
2). Navigate to page : http://IP/vood/cgi-bin/vood_view.cgi?lang=EN&act=user/spec_conf&sessionId=86213915328111654515&user=A&message2user=Account%20updated
3). Insert the generic payload to "Phone Number" parameter
4). Save
Impact:
Stored Cross-Site Scripting (XSS) occurs when malicious scripts are injected into a web application and stored on the server, affecting multiple users who view the compromised content. The impact includes the theft of sensitive information like cookies, session tokens, or user credentials, leading to account hijacking or identity theft. Additionally, attackers can manipulate site content, spread malware, or perform actions on behalf of users, compromising the integrity and security of the website.
Mitigation:
1. Input Validation and Sanitization
2. Output Encoding
3. Content Security Policy (CSP)
4. Use of Secure Libraries and Frameworks
5. Database Escaping |
|---|
| 사용자 | The_Druk (UID 70236) |
|---|
| 제출 | 2024. 08. 13. AM 04:47 (2 연령 ago) |
|---|
| 모더레이션 | 2024. 08. 20. PM 08:02 (8 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 275291 [Genexis Tilgin Home Gateway 322_AS0500-03_05_13_05 Phone Number 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 17 |
|---|