alemusix/cve-2024-41640Proof-of-concept for an unauthenticated reflected cross-site scripting (XSS) vulnerability in AML Surety Eco up to v3.5, demonstrating JavaScript injection via the 'id' parameter in AppError.aspx.
AML Surety Eco up to version 3.5 is affected by an un-authenticated reflected cross-site scripting.
The target web application handles error in a dedicated error page (accessible without any authentication) containing a URL parameter that is not sanitizing user input. The provided parameter value is reflected off the web application causing malicious payloads to execute JavaScript code on the victim’s browser.
The vulnerable parameter:
idIt is possible to inject a JavaScript payload in the id URL parameter
Attacker can provide the URL with JavaScript payload to a victim that upon opening in the browser results in the execution of JavaScript code.
