Smoothwall Express Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in Smoothwall Express version 3.1-SP4-polar-x86_64-update9. This vulnerability allows unauthenticated attackers to inject malicious scripts by manipulating the MACHINES parameter in requests to the timedaccess.cgi endpoint. The injected scripts are executed as arbitrary JavaScript in the browsers of users.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject and execute scripts in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a POST request to the 'timedaccess.cgi' endpoint with the MACHINES parameter containing a script payload, such as a JavaScript alert. The injected script will be executed in the user's browser, demonstrating the cross-site scripting vulnerability.