Flexmonster Pivot Table & Charts 2.7.17 - 'Remote JSON' Reflected XSS

vendor:

Flexmonster Pivot Table & Charts

by:

Marco Nappi

6.1

CVSS

MEDIUM

Reflected XSS

CWE

Product Name: Flexmonster Pivot Table & Charts

Affected Version From: 2.7.17

Affected Version To: 2.7.17

Patch Exists: YES

Related CWE: CVE-2020-20139

CPE: 2.7.17

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Flexmonster Pivot Table & Charts 2.7.17

2020

Flexmonster Pivot Table & Charts 2.7.17 – ‘Remote JSON’ Reflected XSS

Cross Site Scripting (XSS) vulnerability in the Remote JSON component. The Reflected XSS is a result of insufficient input sanitization of the 'path' parameter when fetching the file specifications (file_specs.php). When using this URL the user navigates to an non-existing file (the XSS payload). This results in the execution of the payload.

Mitigation:

Input validation and sanitization should be implemented to prevent XSS attacks.

Source

Exploit-DB raw data:

# Exploit Title: Flexmonster Pivot Table & Charts 2.7.17 - 'Remote JSON' Reflected XSS
# Date: 08/01/2020
# Exploit Author: Marco Nappi
# Vendor Homepage: https://www.flexmonster.com/
# Version: Flexmonster Pivot Table & Charts 2.7.17
# Tested on: Flexmonster Pivot Table & Charts 2.7.17
# CVE : CVE-2020-20139

Cross Site Scripting (XSS) vulnerability in the Remote JSON component 

Reflected XSS:
The Reflected XSS is a result of insufficient input sanitization of the 'path' parameter when fetching the file specifications (file_specs.php). Below I have provided an example URL. When using this URL the user navigates to an non-existing file (the XSS payload). This results in the execution of the payload.

payload:
<svg onload=alert("OpenRemoteJSON")><!--