CVE-2023-36306
published 2023-08-08CVE-2023-36306: A Cross Site Scripting (XSS) vulnerability in Adiscon Aiscon LogAnalyzer through 4.1.13 allows a remote attacker to execute arbitrary code via the…
PriorityP340medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EXPLOIT
EPSS
3.77%
88.6th percentile
A Cross Site Scripting (XSS) vulnerability in Adiscon Aiscon LogAnalyzer through 4.1.13 allows a remote attacker to execute arbitrary code via the asktheoracle.php, details.php, index.php, search.php, export.php, reports.php, and statistics.php components.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adiscon | loganalyzer | <= 4.1.13 | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Adiscon LogAnalyzer v.4.1.13 - Cross Site Scripting
exploitdb·2023-08-04·CVSS 6.1
CVE-2023-36306 [MEDIUM] Adiscon LogAnalyzer v.4.1.13 - Cross Site Scripting
Adiscon LogAnalyzer v.4.1.13 - Cross Site Scripting
---
# Exploit Title: Adiscon LogAnalyzer v.4.1.13 - Cross Site Scripting
# Date: 2023.Aug.01
# Exploit Author: Pedro (ISSDU TW)
# Vendor Homepage: https://loganalyzer.adiscon.com/
# Software Link: https://loganalyzer.adiscon.com/download/
# Version: v4.1.13 and before
# Tested on: Linux
# CVE : CVE-2023-36306
There are several installation method.
If you installed without database(File-Based),No need to login.
If you installed with database, You should login with Read Only User(at least)
XSS Payloads are as below:
XSS
http://[ip address]/loganalyzer/asktheoracle.php?type=domain&query=&uid=%22%3E%3Cscript%3Ealert%28%27XSS%27%29%3C/script%3E
http://[ip address]/loganalyzer/chartgenerator.php?type=2&byfield=syslogseverity&width=400&%%22
Nuclei
Adiscon LogAnalyzer v.4.1.13 - Cross-Site Scripting
nuclei·CVSS 6.1
CVE-2023-36306 [MEDIUM] Adiscon LogAnalyzer v.4.1.13 - Cross-Site Scripting
Adiscon LogAnalyzer v.4.1.13 - Cross-Site Scripting
A Cross Site Scripting (XSS) vulnerability in Adiscon Aiscon LogAnalyzer through 4.1.13 allows a remote attacker to execute arbitrary code via the asktheoracle.php
Template:
id: CVE-2023-36306
info:
name: Adiscon LogAnalyzer v.4.1.13 - Cross-Site Scripting
author: r3Y3r53
severity: medium
description: |
A Cross Site Scripting (XSS) vulnerability in Adiscon Aiscon LogAnalyzer through 4.1.13 allows a remote attacker to execute arbitrary code via the asktheoracle.php
impact: |
Unauthenticated attackers can inject malicious JavaScript through the uid parameter in asktheoracle.php, potentially stealing administrator session cookies and accessing sensitive log analysis data.
remediation: |
Update Adiscon LogAnalyzer to a version newer than
2023-08-08
Published