██╗ ██╗███████╗███████╗
╚██╗██╔╝██╔════╝██╔════╝
╚███╔╝ ███████╗███████╗
██╔██╗ ╚════██║╚════██║
██╔╝ ██╗███████║███████║
╚═╝ ╚═╝╚══════╝╚══════╝
Cross Site Scripting - Oempro
Octech Oempro 4.7 through 4.11 allow XSS by an authenticated user. The parameter CampaignName in Campaign.Create is vulnerable.
Command:Campaign.Create
Request parameter:CampaignName
Version: Oempro v4.7 <= v4.11
Researcher: Guilherme Rubert
Payload:
"><marquee/onstart=alert("XSS")>
References:
https://guilhermerubert.com/blog/cve-2020-9460/
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9460