提交 #503323: Pix Software Vivaz 6.0.11 Reflected Cross Site Scripting

Reflected Cross Site Scripting in Vivaz 6.0.11
Vendor: Pixsoft
Product: Vivaz
Version Affected: 6.0.11
Vulnerability Type: Reflected Cross Site Scripting
Reference: https://www.pixsoft.com.br/vivaz-software-service-desk.htm

Description:
A Reflected Cross-Site Scripting (RXSS) vulnerability was discovered in Vivaz 6.0.11, a software developed by Pixsoft. The vulnerability exists in the following endpoint:

/servlet?act=login&submit=1&evento=0&pixrnd=0125021817031859360231&sistema=teste"><img%20src%20onerror=alert()>
It is important to note that the vulnerable endpoint may require a directory prefix, depending on the deployment. For example:

NAME-OF-ENTERPRISE/servlet?act=login&submit=1&evento=0&pixrnd=0125021817031859360231&sistema=teste"><img%20src%20onerror=alert()>
The parameter sistema does not properly sanitize user input before rendering it in the response, allowing arbitrary JavaScript execution in the user's browser.

Proof of Concept (PoC):
By accessing the following URL:

https://target.com/servlet?act=login&submit=1&evento=0&pixrnd=0125021817031859360231&sistema=teste"><img%20src%20onerror=alert()>
or
https://target.comNAME-OF-ENTERPRISE/servlet?act=login&submit=1&evento=0&pixrnd=0125021817031859360231&sistema=teste"><img%20src%20onerror=alert()>
the browser executes JavaScript, confirming the presence of an RXSS vulnerability.

Impact:
An attacker can exploit this vulnerability to:
Steal user session cookies, potentially leading to account takeover.
Execute arbitrary JavaScript in the victim's browser, enabling phishing or malicious redirects.
Modify the appearance or behavior of the application to deceive users.
Perform actions on behalf of an authenticated user without their consent.

By: Yago Martins

• 来源: ⚠️ https://github.com/yago3008/cves
• 用户: y4g0 (UID 80480)
• 提交: 2025-02-18 21時54分 (2 年前)
• 管理: 2025-03-01 08時50分 (10 days later)
• 状态: 已接受
• VulDB条目: 298068 [Pixsoft Vivaz 6.0.11 Login Endpoint sistema 跨网站脚本]
• 积分: 20