Exploitation Summary
CVE-2017-18024 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.
Description
AvantFAX 3.3.3 has XSS via an arbitrary parameter name to the default URI, as demonstrated by a parameter whose name contains a SCRIPT element and whose value is 1.
Nuclei Templates (1)
AvantFAX 3.3.3 - Cross-Site Scripting
MEDIUMby pikpikcu
Shodan:
http.title:"avantfax - login"
FOFA:
title="avantfax - login"
References (1)
Core 1
Core References
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
http://packetstormsecurity.com/files/145776/AvantFAX-3.3.3-Cross-Site-Scripting.html
Scores
CVSS v3
6.1
EPSS
0.0462
EPSS Percentile
90.5%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Details
CWE
CWE-79
Status
published
Products (1)
avantfax/avantfax
3.3.3
Published
Jan 10, 2018
Tracked Since
Feb 18, 2026