falconz/cve-2019-12189Proof-of-concept for a stored XSS vulnerability in Zoho ManageEngine ServiceDesk Plus 9.3, with a payload exploiting single quote and semicolon confusion in the query string.
Information Description:XSS was discovered in ManageEngine ServiceDesk Plus version Versions Affected: 9.3 Researcher: Dang The Tuyen
The vulnerability stems from the confusion of both single quotes and semicolon in the query string of the URL.
payload: ';alert('XSS');' Attack vector: http:///SearchN.do
