CVE-2021-26844

============================
– CVEID: CVE-2021-26844
– PRODUCT: PA Server Monitor
– VERSION: 8.2.1.1
- VENDOR: Power Admin LLC
– PROBLEM TYPE: Cross-Site Scripting (XSS)
– DESCRIPTION: A Cross-Site Scripting (XSS) vulnerability in Power Admin PA Server Monitor 8.2.1.1 allows remote attackers to inject arbitrary web script or HTML via Console.exe.
============================

Description:
1. Navigate to Settings -> Remote Access -> hint.
2. Insert the following Cross-Site Scripting (XSS) payload.
		<script>alert(document.domain)</script>
3. Refresh the page to trigger Cross Site Scripting (XSS) in the application.

Business Impact:
Cross-site scripting (XSS) vulnerabilities allow remote attackers to inject arbitrary scripts into a victim’s web browser. An attacker can leverage this vulnerability by passing the malicious script to the application, which then gets passed to the user. Since the malicious code is passed through the victim’s browser via the application, the browser cannot differentiate between legitimate and malicious code.  The malicious code can to retrieve cookies, session tokens, and other sensitive information in the application. It even has the potential to deface the application by rewriting the contents of the HTML page.

References:
https://www.poweradmin.com/products/server-monitoring/support/release-notes/
https://owasp.org/www-community/attacks/xss/

Discoverer:
Ryan Jones