Cross-site scripting in Ozeki NG SMS Gateway - CVE-2020-14024

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data passed via the Receiver and Recipient fields in the Mailbox feature, via the OZFORM_GROUPNAME field in the Group configuration of addresses, via the listname field in the Defining address lists configuration, and via any GET Parameter passed to the /default URL of the application. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Remediation

External links

• https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-14024-Multiple%20XSS-Ozeki%20SMS%20Gateway
• https://www.ozeki.hu/index.php?owpn=231