Securin Zero-Days

Issue 1 & 2:

Access the URL, and add XSS payload xss”><script>alert(1)</script> through vulnerable variable path & name to execute XSS in the POST request URL.

Figure 01: Access the URL and browse the registry->browse and add XSS payloads

Figure 02: Add a new property.

Figure 03: XSS payload added to the path variable and gets reflected in the response.

Figure 04: Injected XSS payload gets reflected in the browser.

Figure 05: XSS payload added to the name variable and gets reflected in the response.

Figure 06: Injected XSS payload gets reflected in the browser URL.

Issue 3:Access the GET request URL (added with XSS payload) directly to see XSS getting reflected in the browser.

Figure 07: Access to add new Data Source.

Figure 08: Capturing the GET request and added XSS payload gets reflected in the response.

Figure 9: Injected XSS payload, XSS%22%3e%3cscript%3ealert(1)%3c/script%3e through vulnerable dsProvider gets reflected whenever the user tries to access the URL to add new Data Source.