vendor:
Axis Communications Firmware
by:
Orwelllabs
7,5
CVSS
HIGH
Improper Input Validation
20
CWE
Product Name: Axis Communications Firmware
Affected Version From: Firmwares versions <lt 5.80.x
Affected Version To: Firmwares versions <lt 5.80.x
Patch Exists: YES
Related CWE: CVE-2015-8258
CPE: a:axis_communications:axis_communications_firmware
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Device Administrative Interface/Authentication/Authorization
2015
ImagePath Resource Injection/Open script editor
The variable 'imagePath=' (that is prone to XSS in a large range of products) also can be used to resource injection intents. If inserted a URL in this variable will be made an GET request to this URL, so this an interesting point to request malicious codes from the attacker machine, and of course, the possibilities are vast (including hook the browser).
Mitigation:
Ensure that user input is properly validated and sanitized before being used in the application.
