CVE-2024-6516
CRITICALABB ASPECT Enterprise and NEXUS/MATRIX Series < 3.08.03 - Cross-Site Scripting
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2024-6516. PoCs published by LiquidWorm.
AI-analyzed exploit summary This exploit demonstrates a stored XSS vulnerability in ABB Cylon Aspect's licenseUpload.php. It uploads a malicious .txt file containing an XSS payload, which is stored on the server and executed when accessed by users.
Description
Cross Site Scripting vulnerabilities where found providing a potential for malicious scripts to be injected into a client browser. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02
Exploits (3)
This exploit demonstrates a stored XSS vulnerability in ABB Cylon Aspect's licenseUpload.php. It uploads a malicious .txt file containing an XSS payload, which is stored on the server and executed when accessed by users.
This is a working proof-of-concept for a stored XSS vulnerability in ABB Cylon Aspect's licenseServerUpdate.php. The exploit demonstrates how an authenticated attacker can inject arbitrary JavaScript via the 'host' POST parameter.
This exploit demonstrates an authenticated blind command injection vulnerability in ABB Cylon Aspect's bbmdUpdate.php. The POST parameters (e.g., hexMask2, NAThexMask2) are not sanitized, allowing arbitrary command execution via shell metacharacters (e.g., '; sleep 17; #').
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L