Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2025-57389 — A reflected cross-site scripting vulnerability in OpenWRT v18.06.2 | Kitploit
Tools/GitHubGitHub/amalcew/cve-2025-57389
Vulnerability AnalysisExploitationWeb Application ExploitationWeb SecurityPenetration Testing
GitHubamalcew/cve-2025-57389

CVE-2025-57389

A reflected cross-site scripting vulnerability in OpenWRT v18.06.2

View Repository
10 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2025-57389 - Reflected XSS in OpenWRT 18.06.2

Description

A reflected cross-site scripting (XSS) vulnerability was identified in EOL Luci OpenWRT v18.06.2 on /cgi-bin/luci/admin/system/packages endpoint.

Proof of Concept

  1. While proxying the traffic to Burp, navigate to http://192.168.56.2/cgi-bin/luci/admin/system/packages,
  2. Type any package name in Filter, submit,
  3. Send the POST request to this endpoint to the repeater,
  4. Inside display parameter, type the payload (present on the screenshot below), 1
  5. Send, right-click in Repeater tab, Request in browser. Copy the link into the browser
  6. To execute the payload, click Reset button 2

Root Cause

The root cause of the vulnerability is insufficient input sanitization, which allows threat actor to break out of the string and directly execute JavaScript payload.

Impact

Exploitation of this vulnerability could allow the attacker to exfiltrate session tokens (cookies), potentially leading to account takeover.

Affected Version Details

Luci - OpenWRT 18.06.2, branch (git-19.020.41695-6f6641d) - source code

References

  • https://portswigger.net/web-security/cross-site-scripting/contexts
Download Tool