Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

Categories

View all categories

Loading categories

CVE-2024-42834 — Proof-of-concept exploit for CVE-2024-42834, a stored cross-site scripting (XSS) vulnerability in Incognito SAC UI 14.11 via the customerManager API lastName parameter. | Kitploit

Tools/

GitHub/cybersec-supra/cve-2024-42834

Vulnerability Analysis Exploitation Web Application Exploitation Web Security Penetration Testing

cybersec-supra/cve-2024-42834

CVE-2024-42834

Proof-of-concept exploit for CVE-2024-42834, a stored cross-site scripting (XSS) vulnerability in Incognito SAC UI 14.11 via the customerManager API lastName parameter.

View Repository

2 years ago

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →

Date: 26 JULY 2024

Exploit Author: Etienne Supra

Vendor Homepage: https://www.incognito.com/products/service-activation-center/

Version: 14.11

CVE : CVE-2024-42834

Vendor has been informed and acknowledge the vulnerability.

VULNERABILITY SUMMARY A stored Cross-site scripting (XSS) vulnerability was identified in the customerManager API and ManageAccount_retrieve modules of the Incognito Service Activation Center User Interface (SAC UI). SAC UI Version 14.11 allows remotely authenticated attackers to inject arbitrary JavaScript or HTML via the ‘lastName’ parameter. If malicious JavaScript was submitted, it would be stored on the web server and would be triggered on users’ browsers when viewed. The XSS was triggered when the user account was viewed on the ManageAccount_retrieve page. The remediation of this vulnerability lies with the vendor, as they would need to sanitise the API input and the SAC UI output.

Download Tool