LiveZilla blind Javascript Injection - Cross Site Scripting (XSS)

LiveZilla blind Javascript Injection – Cross Site Scripting (XSS)

http://justmusing.net/cwttoxqm.php?Fox=d3wL7 Overview :

An issue was discovered in chat.php in LiveZilla Live Chat 8.0.1.3 (Helpdesk). A blind JavaScript injection lies in the name parameter. Triggering this can fetch the username and passwords of the helpdesk employees in the URI. This leads to a privilege escalation, from unauthenticated to user-level access, leading to full account takeover. The attack fetches multiple credentials because they are stored in the database (stored XSS). This affects the mobile/chat URI via the lgn and psswrd parameters.

http://shinyfastandloud.com/?p=603 Affected Product(s) :

LiveZilla Live Chat 8.0.1.3

Vulnerability Details :

CVE ID :

CVE-2020-9758

The leakage of credentials through the URI may be the result of the autologin feature. Also more parameters in the chat.php form may be vulnerable.

Solution :

Awaited

Contact us to get started

CVE-2024-32608 : HDF5 UP TO 1.14.3 H5A__CLOSE MEMORY CORRUPTION

Description HDF5 library through 1.14.3 has memory corruption in H5A__close resulting in the corruption of the instruction pointer and causing

Learn more

CVE-2024-45160 : LEMONLDAP::NG UP TO 2.19.1 OAUTH2 CLIENT AUTHENTICATION CLIENT_PASSWORD IMPROPER AUTHENTICATION

Description Incorrect credential validation in LemonLDAP::NG 2.18.x and 2.19.x before 2.19.2 allows attackers to bypass OAuth2 client authentication via an

Learn more

CVE-2024-45179 : ZA-INTERNET C-MOR VIDEO SURVEILLANCE 5.2401/6.00PL01 WEB INTERFACE SETTIMEZONE.PML CITY OS COMMAND INJECTION

Description An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01. Due to insufficient input validation, the C-MOR

Learn more