Smoothwall Express Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in Smoothwall Express version 3.1-SP4-polar-x86_64-update9. This vulnerability allows unauthenticated attackers to inject malicious scripts by manipulating the NTP_SERVER parameter. Attackers can send POST requests to the time.cgi endpoint with script payloads in the NTP_SERVER parameter, executing arbitrary JavaScript in users' browsers.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a POST request to the 'time.cgi' endpoint with a script payload injected into the 'NTP_SERVER' parameter. The injected script will be executed in the user's browser, demonstrating the cross-site scripting vulnerability.