CVE-2019-25399
MEDIUMIPFire 2.21 Core Update 127 - Stored Cross-Site Scripting via extrahd.cgi FS PATH and UUID Parameters
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2019-25399. PoCs published by Ozer Goker.
AI-analyzed exploit summary This exploit demonstrates multiple reflected and stored XSS vulnerabilities in IPFire 2.21 Core Update 127. It provides specific URLs, methods, parameters, and payloads to trigger XSS in various CGI scripts.
Description
IPFire 2.21 Core Update 127 contains multiple stored cross-site scripting vulnerabilities in the extrahd.cgi script that allow attackers to inject malicious scripts through the FS, PATH, and UUID parameters. Attackers can submit POST requests with script payloads in these parameters to execute arbitrary JavaScript in the context of authenticated administrator sessions.
Exploits (1)
This exploit demonstrates multiple reflected and stored XSS vulnerabilities in IPFire 2.21 Core Update 127. It provides specific URLs, methods, parameters, and payloads to trigger XSS in various CGI scripts.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N