PT-2020-16100 · Xinuo · Xinuo Openserver

Ramikan · Published 2020-12-18 · Updated 2020-12-22 · CVE-2020-25495

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Xinuo Openserver versions 5 and 6

Description A reflected Cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML tag via the parameter section. This enables attackers to potentially execute malicious scripts on the victim's browser.

Recommendations For Xinuo Openserver version 5: Update to a version that fixes this issue. For Xinuo Openserver version 6: Update to a version that fixes this issue. As a temporary workaround, consider restricting access to the section parameter to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-25495

Affected Products

Xinuo Openserver

References · 8

• 🔥 https://github.com/Ramikan/Vulnerabilities/blob/master/SCO%20Openserver%20XSS%20%26%20HTML%20Injection%20vulnerability · Exploit
• 🔥 http://packetstormsecurity.com/files/160634/SCO-Openserver-5.0.7-Cross-Site-Scripting.html · Exploit
• 🔥 https://exploit-db.com/exploits/49300 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-25495 · Security Note
• https://osv.dev/vulnerability/CVE-2020-25495 · Vendor Advisory
• https://t.me/cvenotify/7482 · Telegram Post
• https://t.me/cvenotify/7350 · Telegram Post
• https://t.me/cibsecurity/21077 · Telegram Post