iWT FaceSentry Access Control System Cross-Site Scripting Vulnerability

A cross-site scripting vulnerability has been identified in the iWT FaceSentry Access Control System version 6.4.8. The issue arises in the 'msg' parameter of the 'pluginInstall.php' script, where user input is not properly validated. This flaw allows attackers to inject malicious scripts that are executed in the context of the user's browser, potentially leading to the theft of authentication cookies and facilitating phishing attacks.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where injected scripts are executed in the context of the affected user.

Reproduction

To reproduce this vulnerability, send a GET request to 'pluginInstall.php' with a crafted 'msg' parameter that includes the desired JavaScript payload. Once the URL is accessed, the injected script will execute in the browser.