Smoothwall Express Stored Cross-Site Scripting Vulnerability in Preferences CGI

A stored cross-site scripting vulnerability has been identified in Smoothwall Express version 3.1-SP4-polar-x86_64-update9. The issue resides in the preferences.cgi script, where attackers can inject malicious scripts through the HOSTNAME, KEYMAP, and OPENNESS parameters. These injected scripts are then executed in the browsers of users who access the preferences page.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the affected page.

Reproduction

To reproduce this vulnerability, send a POST request to the preferences.cgi script with a payload containing a script tag injected into one of the vulnerable parameters: HOSTNAME, KEYMAP, or OPENNESS. The injected script will be executed when the preferences page is accessed.