Grandstream GXP1405 Executive IP Phone 1.0.1.110 XSS

`>--------------------------------------------------------------------------------  
title: Grandstream GXP1405 Executive IP Phone Persistent XSS  
product: Grandstream Networks  
vulnerable version: 1.0.1.110  
impact: Low  
homepage: www.grandstream.com  
found: 23.10.2012  
by: aulmn  
>--------------------------------------------------------------------------------  
Vendor description:  
  
Grandstream Networks is a leading manufacturer of innovative IP voice/video  
telephony and video surveillance solutions  
  
>--------------------------------------------------------------------------------  
Vulnerability overview/description:  
  
This is cross-site scripting for logged in users.  
  
>--------------------------------------------------------------------------------  
Proof of concept:  
  
Go to Your http://ip.of.tel/cgi-bin/login and log in.  
Next check card called 'Accounts' and then vulnerable parameter is P134.  
Click 'update' and ance again 'continue'. And here Your xss in triggered.  
Parameter P2318 is vulnerable too, so I suppose there is more vulnerable  
places.  
  
'Conference URL' parameter is also vulnerable to persistent xss.  
So if attacker will get your (default? ;)) credentials, then he can set  
persistent xss to attack you.  
  
>--------------------------------------------------------------------------------  
Vulnerable / tested versions:  
  
Software Version 1.0.1.110  
  
(The vulnerability is verified to exist in Grandstream GXP1405.  
Older versions are probably affected as well.)  
  
>--------------------------------------------------------------------------------  
Vendor contact timeline:  
Nope.  
  
Solution:  
>--------------------------------------------------------------------------------  
Please validate content delivered by your users.  
  
>--------------------------------------------------------------------------------  
Advisory URL:  
Maybe later.  
  
_________________________________________________________________________________  
Contact:  
[email protected]  
`