eGain Chat 15.5.5 Cross Site Scripting

`# Exploit Title: eGain Chat 15.5.5 Cross-Site Scripting  
# Vendor Homepage: https://www.egain.com/  
# Software Link: https://www.egain.com/chat-software/  
# Exploit Authors: Brandon Ming Yang Ho (https://www.linkedin.com/in/minhobrandon/), Hassy Vinod Eshan (https://www.linkedin.com/in/hassy-vinod/)  
# CVE: CVE-2020-15948  
  
# Timeline  
  
- June 2020: Initial vulnerability discovery  
- July 2020: Reported to eGain Corporation  
- August 2020: Fix/patch provided by eGain Corporation  
- September 2020: Public disclosure notified to eGain Corporation  
- July 2021: Published CVE-2020-15948  
  
# 1. Introduction  
  
eGain Chat is a real time chat assistance solution by eGain Corporation for website visitors to communicate with chat agents.  
  
# 2. Vulnerability Details  
  
eGain Chat version 15.5.5 is vulnerable to reflected Cross-Site Scripting (Reflected XSS).  
  
The “Name” input field (full_name) does not fully sanitise user input for special characters such as “<” or “>” and HTML attributes such as “<a href>”. It is possible for an attacker to bypass filtering and create malicious scripts. Once the response has been rendered, the malicious JavaScript code would be executed.  
  
# 3. Proof of Concept  
  
The “Name” input field (full_name) of the chat window can be injected with the following XSS payload as a Proof of Concept to execute a javascript alert popup.  
  
Payload - <a href="javascript&#58alert(document.domain)">click</a>  
  
# 4. Remediation  
  
Apply the latest fix/patch from eGain Corporation.  
  
# 5. Credits  
  
- Brandon Ming Yang Ho (https://www.linkedin.com/in/minhobrandon/)  
- Hassy Vinod Eshan (https://www.linkedin.com/in/hassy-vinod/)  
`