Actions
Bug #9294
closed
JP
JP
XSS issues on multiple pages
Bug #9294:
XSS issues on multiple pages
Start date:
01/29/2019
Due date:
% Done:
100%
Estimated time:
Plus Target Version:
Release Notes:
Affected Version:
2.4.x
Affected Architecture:
All
Description
A list of 30 XSS issues was posted publicly without following responsible disclosure practices, they all need tested/confirmed/fixed. Only 14 are unique, the rest are duplicated.
6 pages affected in total.
Report details:
| ID | Type | URL | Method | Parameter | Payload |
|---|---|---|---|---|---|
| XSS1 | Reflected | /system_advanced_admin.php | Post | webguiproto | "><script>alert(1)</script> |
| XSS2 | Reflected | /interfaces_assign.php | Post | wan | "><script>alert(2)</script> |
| XSS3/11/19 | Stored | /firewall_rules_edit.php | Post | dscp | "><script>alert(3)</script> |
| XSS4/12/20 | Stored | /firewall_rules_edit.php | Post | tag | "><script>alert(4)</script> |
| XSS5/13/21 | Stored | /firewall_rules_edit.php | Post | tagged | "><script>alert(5)</script> |
| XSS6/14/22 | Stored | /firewall_rules_edit.php | Post | statetype | "><script>alert(6)</script> |
| XSS7/15/23 | Stored | /firewall_rules_edit.php | Post | vlanprio | "><script>alert(7)</script> |
| XSS8/16/24 | Stored | /firewall_rules_edit.php | Post | vlanprioset | "><script>alert(8)</script> |
| XSS9/17/25 | Stored | /firewall_rules_edit.php | Post | dnpipe | "><script>alert(9)</script> |
| XSS10/18/26 | Stored | /firewall_rules_edit.php | Post | defaultqueue | "><script>alert(10)</script> |
| XSS27 | Reflected | /firewall_shaper.php | Post | name | "><script>alert(27)</script> |
| XSS28 | Stored | /services_igmpproxy_edit.php | Post | address0 | "><script>alert(28)</script> |
| XSS29 | Stored | /services_ntpd_gps.php | Post | gpstype | "><script>alert(29)</script> |
| XSS30 | Reflected | /diag_traceroute.php | Post | host | "><script>alert(30)</script> |
- Exploit Author: Ozer Goker
Actions