In Paradox Security System IPR512 Web console login form page, attacker can input JavaScript string, such as </script> that will overwrite configurations in the file "login.xml" and cause the login form to crash and make it unavailable.
!!!WARNING!!! Be aware that it will make a damaging impact on the service functioning!
1. The Paradox Security Systems IPR512 Account Management webpanel is accessible. Typing "admin" as a user.
2. Intercepting request with BurpSuite.
3. Changing "admin" with JavaScript tag </script>
4. URL encoding </script> to bypass security filter and sending request.
5. If accessing the login.xml isn't restricted, you can check that it is overwritten.
6. The webpanel login form isn't accessible anymore as it is crashed.
Code injection vulnerability in login.html in Web panel login page on IPR512 of the Paradox Security Systems product that allows a remote or local attacker to cause the web panel login page crash via injecting easy JavaScript code into login form page such as </script>.