vendor:
Axioscloud Sissiweb Registro Elettronico
by:
Dino Barlattani
7.5
CVSS
HIGH
Cross-Site Scripting
79
CWE
Product Name: Axioscloud Sissiweb Registro Elettronico
Affected Version From: 1.7.0
Affected Version To: 7.0.0
Patch Exists: NO
Related CWE: N/A
CPE: a:axiositalia:axioscloud_sissiweb_registro_elettronico
Metasploit:
N/A
Other Scripts:
N/A
Platforms Tested: ASPX
2018
Axioscloud Sissiweb Registro Elettronico 7.0.0 – ‘Error_desc’ Cross-Site Scripting
Axioscloud Sissiweb Registro Elettronico is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
Mitigation:
Input validation should be used to ensure that untrusted data is not allowed into the application. All input data should be validated and filtered for malicious content. It is also important to ensure that output is properly encoded before being returned to the user.
