Flexmonster pivot table & charts 2.7.17 to remote csv reflected xss Vulnerability / Exploit

  /     /     /  

Exploits / Vulnerability Discovered : 2020-12-21 | Type : webapps | Platform : multiple
This exploit / vulnerability Flexmonster pivot table & charts 2.7.17 to remote csv reflected xss is for educational purposes only and if it is used you will do on your own risk!

---

[+] Code ...

# Exploit Title: Flexmonster Pivot Table & Charts 2.7.17 - 'To remote CSV' Reflected XSS
# Date: 08/01/2020
# Exploit Author: Marco Nappi
# Vendor Homepage: https://www.flexmonster.com/
# Version:Flexmonster Pivot Table & Charts 2.7.17
# Tested on:Flexmonster Pivot Table & Charts 2.7.17
# CVE : CVE-2020-20142

Cross Site Scripting (XSS) vulnerability in the "To Remote CSV" component under "Open" Menu in Flexmonster Pivot Table & Charts 2.7.17.

Reflected XSS:
The Reflected XSS is a result of insufficient input sanitization of the 'path' parameter when fetching the file specifications (file_specs.php). Below I have provided an example URL. When using this URL the user navigates to an non-existing file (the XSS payload). This results in the execution of the payload.

payload:
<svg onload=alert("OpenRemoteCSV")><!--