| 제목 | Cairo-dock Glx-Dock 3.4.0 Cross Site Scripting |
|---|
| 설명 | A reflected cross-site scripting (XSS) vulnerability was identified in the glx-dock.org web application, specifically in the /ww_page.php endpoint. The lang and p query parameters are rendered into the HTML response without proper sanitization or output encoding, allowing an attacker to inject arbitrary JavaScript code. By crafting a malicious URL containing an HTML image tag with an onerror event handler (e.g., "><img src=x onerror=prompt(8)>), script execution is triggered in the context of the victim's browser session upon visiting the link. This can be leveraged for session hijacking, credential theft, or phishing attacks against users of the affected website. No authentication is required to exploit this vulnerability.
payload:
https://glx-dock.org/ww_page.php?lang=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%288%29%3E&p=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%288%29%3E |
|---|
| 원천 | ⚠️ https://glx-dock.org/ww_page.php |
|---|
| 사용자 | Havook (UID 71104) |
|---|
| 제출 | 2026. 09. 10. PM 07:30 (1 월 ago) |
|---|
| 모더레이션 | 2026. 10. 11. PM 01:39 (1 month later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 416608 [Cairo-dock Glx-Dock 까지 3.4.0 Query Parameter ww_page.php 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 17 |
|---|