AXON PBX 2.02 Cross Site Scripting

`Aloha,  
  
*1. Introduction*  
  
Vendor: NCH Software  
Affected Product: AXON PBX - 2.02  
Vendor Website: http://www.nch.com.au/pbx/index.html  
Vulnerability Type: Reflected XSS  
Remote Exploitable: Yes  
CVE ID: CVE-2018-11552  
  
*2. Overview*  
  
There is a reflected XSS vulnerability in AXON PBX Web interface. The  
vulnerability exists due to insufficient filtration of user-supplied data.  
A remote attacker can execute arbitrary HTML and script code in browser in  
context of the vulnerable application.  
  
*3. Affected Parameter*  
'Name' Parameter (Go to AXON->Auto-Dialer->Agents->Name)  
  
*4. Payload*  
<script>alert('XSS')</script>  
  
  
*5. Credit*  
Himanshu Mehta (@LionHeartRoxx)  
  
Chao,  
  
Himanshu Mehta  
`