FaceSentry Access Control System 6.4.8 Reflected Cross Site Scripting
Posted by deepcore on July 2, 2019 – 3:12 pm
FaceSentry Access Control System version 6.4.8 is vulnerable to multiple cross site scripting vulnerabilities. This issue is due to the application’s failure to properly sanitize user-supplied input thru the ‘msg’ parameter (GET) in pluginInstall.php script. An attacker may leverage any of the cross-site scripting issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials, phishing, as well as other attacks.
Post a reply
You must be logged in to post a comment.