vendor:
html5_snmp
by:
Cakes
8.8
CVSS
HIGH
Persistent Cross-Site Scripting
79
CWE
Product Name: html5_snmp
Affected Version From: 1.11
Affected Version To: 1.11
Patch Exists: NO
Related CWE: N/A
CPE: html5_snmp
Metasploit:
N/A
Other Scripts:
N/A
Platforms Tested: CentOS 7
2019
html5_snmp 1.11 – ‘Remark’ Persistent Cross-Site Scripting
A persistent cross-site scripting vulnerability exists in html5_snmp 1.11. An attacker can send a malicious POST request to the add_router_operation.php script with a crafted 'Remark' parameter containing a malicious JavaScript payload. This payload will be stored in the application and executed when the page is loaded by a victim.
Mitigation:
Input validation should be used to prevent malicious code from being stored in the application. Additionally, the application should be configured to use a Content Security Policy (CSP) to prevent malicious code from being executed.
