# Exploit Title: eGain Chat 15.5.5 Cross-Site Scripting
# Vendor Homepage: https://www.egain.com/
# Software Link: https://www.egain.com/chat-software/
# Exploit Authors: Brandon Ming Yang Ho (https://www.linkedin.com/in/minhobrandon/), Hassy Vinod Eshan (https://www.linkedin.com/in/hassy-vinod/)
# CVE: CVE-2020-15948
# CVSS Score: Medium (CVSS 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
- June 2020: Initial vulnerability discovery
- July 2020: Reported to eGain Corporation
- August 2020: Fix/patch provided by eGain Corporation
- September 2020: Public disclosure notified to eGain Corporation
- July 2021: Published CVE-2020-15948
# 1. Introduction
eGain Chat is a real time chat assistance solution by eGain Corporation for website visitors to communicate with chat agents.
# 2. Vulnerability Details
eGain Chat version 15.5.5 is vulnerable to reflected Cross-Site Scripting (Reflected XSS).
# 3. Proof of Concept
# 4. Remediation
Apply the latest fix/patch from eGain Corporation.
# 5. Credits
- Brandon Ming Yang Ho (https://www.linkedin.com/in/minhobrandon/)
- Hassy Vinod Eshan (https://www.linkedin.com/in/hassy-vinod/)