| 标题 | Genexis Tilgin Home Gateway 322_AS0500-03_05_13_05 Injection |
|---|
| 描述 | Description:
Stored XSS, also known as persistent XSS, occurs when a malicious script is injected directly into a web application's stored data (e.g., database, file system). This type of XSS is especially dangerous because the malicious script is served to any user who accesses the affected page. The attacker typically exploits a vulnerable input field (such as a comment section or profile field) to store their script. When other users visit the page where the script is stored, it executes in their browser as if it was legitimate content from the web application, leading to potential data theft, session hijacking, or other malicious activities.
#Steps to Reproduce
1). Login to - http://IP/vood/cgi-bin/vood_view.cgi?act=index&lang=EN#
2). Navigate to page : http://IP/vood/cgi-bin/vood_view.cgi?lang=EN&act=user/spec_conf&sessionId=86213915328111654515&user=A&message2user=Account%20updated
3). Insert the generic payload to "Phone Number" parameter
4). Save
Impact:
Stored Cross-Site Scripting (XSS) occurs when malicious scripts are injected into a web application and stored on the server, affecting multiple users who view the compromised content. The impact includes the theft of sensitive information like cookies, session tokens, or user credentials, leading to account hijacking or identity theft. Additionally, attackers can manipulate site content, spread malware, or perform actions on behalf of users, compromising the integrity and security of the website.
Mitigation:
1. Input Validation and Sanitization
2. Output Encoding
3. Content Security Policy (CSP)
4. Use of Secure Libraries and Frameworks
5. Database Escaping |
|---|
| 用户 | The_Druk (UID 70236) |
|---|
| 提交 | 2024-08-13 04時47分 (2 年前) |
|---|
| 管理 | 2024-08-20 20時02分 (8 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 275291 [Genexis Tilgin Home Gateway 322_AS0500-03_05_13_05 Phone Number 跨网站脚本] |
|---|
| 积分 | 17 |
|---|