Fogproject up to 1.6.0-beta.2312 Group Inventory tab fogpage.class.php buildRow sysproduct/sysserial cross site scripting

Summaryinfo

A vulnerability labeled as problematic has been found in Fogproject up to 1.6.0-beta.2312. This vulnerability affects the function buildRow of the file fogpage.class.php of the component Group Inventory tab. Executing a manipulation of the argument sysproduct/sysserial can lead to cross site scripting. This vulnerability is handled as CVE-2026-47689. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in Fogproject up to 1.6.0-beta.2312. It has been declared as problematic. This vulnerability affects the function buildRow of the file fogpage.class.php of the component Group Inventory tab. The manipulation of the argument sysproduct/sysserial with an unknown input leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. As an impact it is known to affect integrity. CVE summarizes:

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `buildRow()` method in `fogpage.class.php` substitutes data values into HTML table cell templates using `str_replace()` without any HTML escaping. An unauthenticated attacker who knows any registered host's MAC address can POST malicious inventory values (e.g. `sysproduct`, `sysserial`) to `/service/inventory.php`, which stores them in the database. When an administrator opens the Group Inventory tab, the payload renders as executable HTML/JavaScript in the admin's browser. Versions 1.5.10.1832 and 1.6.0-beta.2313 fix the issue.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-47689 since 05/19/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1059.007.

By approaching the search of inurl:fogpage.class.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 1.5.10.1832 or 1.6.0-beta.2313 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Project Management Software

Name

• Fogproject

Version

• 1.6.0-beta.2312

Website

• Product: https://github.com/FOGProject/fogproject/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion