AXON PBX 2.02 Cross Site Scripting

AXON PBX version 2.02 suffers from a cross site scripting vulnerability.

MD5 | c7b7efaa05186b62f050f3c020baa340


*1. Introduction*

Vendor: NCH Software
Affected Product: AXON PBX - 2.02
Vendor Website:
Vulnerability Type: Reflected XSS
Remote Exploitable: Yes
CVE ID: CVE-2018-11552

*2. Overview*

There is a reflected XSS vulnerability in AXON PBX Web interface. The
vulnerability exists due to insufficient filtration of user-supplied data.
A remote attacker can execute arbitrary HTML and script code in browser in
context of the vulnerable application.

*3. Affected Parameter*
'Name' Parameter (Go to AXON->Auto-Dialer->Agents->Name)

*4. Payload*

*5. Credit*
Himanshu Mehta (@LionHeartRoxx)


Himanshu Mehta

Related Posts