Vulnerable Endpoint

The msg parameter is reflected directly in the HTML response without sanitization or output encoding.

Proof of Concept

Payload

Decoded:

Result

When the crafted URL is accessed, the injected payload executes in the victim's browser:

Attack Scenario

1. The attacker crafts a malicious URL containing the XSS payload in the msg parameter.
2. The victim is tricked into clicking the link (via phishing, social engineering, etc.).
3. The page loads and the injected JavaScript executes in the victim's browser context — no authentication required.

Impact

• Arbitrary JavaScript execution in the victim's browser
• Session hijacking via cookie theft
• Phishing and social engineering attacks
• Sensitive data exfiltration
• Content defacement within the application context

Recommendations

• Output encoding: Encode all user-supplied input before rendering it in HTML responses (HTML entity encoding at minimum).
• Secure templating: Use a templating engine with auto-escaping enabled.
• Content Security Policy (CSP): Implement a strict CSP with restrictive script-src directives.
• Input validation: Reject or strip parameters containing HTML tags or script sequences at the input layer.

Disclosure Timeline

Credits

Discovered and reported by Luiz Eduardo

CVE-2025-69606 · CWE-79 · GSVoIP Web Panel v2.0.90