A reflected XSS (Cross-Site Scripting) vulnerability has been discovered in HadSky v7.6.3. The vulnerability allows for the execution of arbitrary HTML/javascript code, potentially resulting in the theft of sensitive user information.
Details
The vulnerability is located in the chklogin.php of the application, and the vulnerability occurs because the referer is not escaped and is directly output to the page.
The execution of arbitrary HTML or JavaScript code in the context of the user's browser can lead to a plethora of cyber threats such as:
Stealing user session cookies, leading to session hijacking.
Conducting phishing attacks by displaying false information.
Defacing the website or creating havoc affecting the website's reputation.
Gaining control of the user's interaction with the application for their benefit.
Recommendations
To effectively mitigate this vulnerability, it is strongly recommended to:
Implement proper input validation before utilizing user input in application logic.
Utilize Content-Security-Policy (CSP) to limit the impact of XSS.
Hebing123
commented
4 months ago
Summary
A reflected XSS (Cross-Site Scripting) vulnerability has been discovered in HadSky v7.6.3. The vulnerability allows for the execution of arbitrary HTML/javascript code, potentially resulting in the theft of sensitive user information.
Details
The vulnerability is located in the chklogin.php of the application, and the vulnerability occurs because the referer is not escaped and is directly output to the page.
Proof of Concept (POC)
Affected Component
File: phpscript/chklogin.php
Impact
The execution of arbitrary HTML or JavaScript code in the context of the user's browser can lead to a plethora of cyber threats such as: Stealing user session cookies, leading to session hijacking. Conducting phishing attacks by displaying false information. Defacing the website or creating havoc affecting the website's reputation. Gaining control of the user's interaction with the application for their benefit.
Recommendations
To effectively mitigate this vulnerability, it is strongly recommended to: Implement proper input validation before utilizing user input in application logic. Utilize Content-Security-Policy (CSP) to limit the impact of XSS.