Persistent XSS in Abus Security Center - CVSS 8.0

Hi@all,=20

Product: Abus Security Cams=20
Vendor:Abus Group =20

Internal reference: -=20
Vulnerability type: Cross Site Scripting=20
Vulnerable version: 0101a and possible other versions affected (not =
tested)
Vulnerable component: FTP
Report confidence: Confirmed
Solution status: Not fixed by Vendor, will not patch the vuln.=20
Fixed versions: -
Researcher credits: Tim Schughart & Khanh Quoc Pham of ProSec Networks
Vendor notification: 2016-09-21
Solution date:=20
Public disclosure: 2016-09-29
CVE reference:=20
CVSSv3: 8.0 AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Vulnerability Details:
The entered username via FTP login is reflected to the log which is =
rendered in the web interface without input validation. This results in =
an successfull, persistent, XSS.

Risk:
Through this you are able to get e.g. the session cookies of the cams =
administrator. So you are able to get full access - persistent.=20

PoC:=20
FTP Username: <script>alert(document.cookie)</script>=20
FTP Pass: any=20

Browse to log and watch the popup :)=20


Best regards / Mit freundlichen Gr=C3=BC=C3=9Fen=20

Tim Schughart=20
CEO / Gesch=C3=A4ftsf=C3=BChrer =20

--
ProSec Networks e.K.
Ellingshohl 82
56076 Koblenz=20

Website: https://www.prosec-networks.com=20
E-Mail: [email protected]=20
Mobile: +49 (0)157 7901 5826
Phone: +49 (0)261 450 930 90

"This E-Mail communication may contain CONFIDENTIAL, PRIVILEGED and/or =
LEGALLY PROTECTED information and is intended only for the named =
recipient(s). Any unauthorized use, dissemination, copying or forwarding =
is strictly prohibited. If you are not the intended recipient and have =
received this email communication in error, please notify the sender =
immediately, delete it and destroy all copies of this E-Mail. VAT ID: =
DE290654714 legal domicile Koblenz, HRA 21621.=E2=80=9C

"Diese E-Mail Mitteilung kann VERTRAULICHE, dem BERUFSGEHEIMNIS =
UNTERLIEGENDE und/oder RECHTLICH GESCH=C3=9CTZTE Informationen enthalten =
und ist ausschlie=C3=9Flich f=C3=BCr den/die genannten Adressaten =
bestimmt. Jede unbefugte Nutzung, Weitergabe, Vervielf=C3=A4ltigung oder =
Versendung ist strengstens verboten. Sollten Sie nicht der angegebene =
Adressat sein und diese E-Mail Mitteilung irrt=C3=BCmlich erhalten =
haben, informieren Sie bitte sofort den Absender, l=C3=B6schen diese =
E-Mail und vernichten alle Kopien. USt-IdNr.:  DE290654714, Amtsgericht =
Koblenz, HRA 21621."=