[ authorization ] [ registration ] [ restore account ]
Contact us
You can contact us by:
0day Today Exploits Market and 0day Exploits Database

Logitech Media Server 7.9.0 - favorites Cross-Site Scripting Vulnerability

Author
Dewank Pant
Risk
[
Security Risk Medium
]
0day-ID
0day-ID-28962
Category
web applications
Date add
06-11-2017
CVE
CVE-2017-16567
Platform
multiple
# Exploit Title: Logitech Media Server : Persistent Cross Site Scripting(XSS)
# Shodan Dork: Search Logitech Media Server
# Date: 11/03/2017
# Exploit Author: Dewank Pant
# Vendor Homepage: www.logitech.com
# Software Link: [download link if available]
# Version: 7.9.0
# Tested on: Windows 10, Linux
# CVE : Applied For.
 
 
 
POC:
 
Access and go to the favorites tab and add a new favorite.
Add script as the value of the field.
Payload : <script> alert(1)</script>
Script saved and gives a pop-up to user every time they access that page.
Therefore, Persistent XSS.

#  0day.today [2024-12-25]  #