Smoothwall Express Reflected Cross-Site Scripting Vulnerability in DHCP CGI Script

A reflected cross-site scripting vulnerability has been identified in Smoothwall Express version 3.1-SP4-polar-x86_64-update9. The issue resides in the DHCP CGI script, where attackers can inject malicious scripts through various parameters. By sending POST requests to dhcp.cgi with script payloads in parameters such as BOOT_SERVER, BOOT_FILE, BOOT_ROOT, and others, attackers can execute arbitrary JavaScript in the browsers of users.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where injected scripts are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a POST request to the 'dhcp.cgi' script with a payload containing JavaScript, injected through one of the vulnerable parameters. The script will be executed in the user's browser, demonstrating the cross-site scripting vulnerability.