Exploit for Cross-site Scripting in Netgate Pfsense

🗓️ 23 Oct 2024 10:50:01Reported by EQSTLabType

CVE-2024-46538 PfSense Stored XSS lead to RCE PoC. A cross-site scripting (XSS) vulnerability in pfsense v2.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the $pconfig variable at interfaces_groups_edit.php. Lack of filtering in the $pconfig variable in interfaces_groups_edit.php leads to a cross-site scripting (XSS) vulnerability. The purpose of this project is to help people learn about this vulnerability, and perhaps test their own applications

Reporter	Title	Published	Views	Family All 11
GithubExploit	Exploit for Cross-site Scripting in Netgate Pfsense	4 Dec 202415:51	–	githubexploit
BDU FSTEC	The vulnerability of the $pconfig variable in the interfaces_groups_edit.php file of the software network interface controller based on the FreeBSD Netgate pfSense operating system allows a hacker to execute arbitrary code.	28 Oct 202400:00	–	bdu_fstec
Circl	CVE-2024-46538	22 Oct 202420:28	–	circl
CNNVD	pfSense 跨站脚本漏洞	22 Oct 202400:00	–	cnnvd
CVE	CVE-2024-46538	22 Oct 202400:00	–	cve
Cvelist	CVE-2024-46538	22 Oct 202400:00	–	cvelist
NVD	CVE-2024-46538	22 Oct 202417:15	–	nvd
OSV	CVE-2024-46538	22 Oct 202417:15	–	osv
Positive Technologies	PT-2024-7225 · Pfsense · Pfsense	12 Oct 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-46538	23 May 202510:41	–	redhatcve