GestSup < 3.2.60 Stored XSS in API Error Logs

GestSup versions prior to 3.2.60 contain a pre-authentication stored cross-site scripting (XSS) vulnerability in the API error logging functionality. By sending an API request with a crafted X-API-KEY header value (for example, to /api/v1/ticket.php), an unauthenticated attacker can cause attacker-controlled HTML/JavaScript to be written to log entries. When an administrator later views the affected logs in the web interface, the injected content is rendered without proper output encoding, resulting in arbitrary script execution in the administrator’s browser session.

N/A

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

GESTSUP 跨站脚本漏洞

GESTSUP是法国GESTSUP公司的一个应用软件。是100％基于Web的SUPport MANAGEMENT软件，它可以管理票证和设备。 GESTSUP 3.2.56及之前版本存在跨站脚本漏洞，该漏洞源于API错误日志记录功能中存在缺陷，可能导致未经身份验证的攻击者注入HTML或javascript代码，并在管理员查看日志时执行任意脚本。

N/A

N/A