GOautodial Persistent Cross-Site Scripting Vulnerability

A persistent cross-site scripting vulnerability has been identified in GOautodial version 4.0. This vulnerability allows authenticated agents to inject malicious scripts into message subjects. When an administrator reads these messages, the embedded JavaScript executes, potentially leading to session cookie theft or other client-side attacks.

Impact

Exploitation of this vulnerability allows for persistent cross-site scripting, where injected scripts are executed when the message is read by an administrator.

Reproduction

To reproduce this vulnerability, log in as an agent and send a message to the user 'goadmin' with a subject that includes a script tag, such as one that alerts document cookies. Once the message is sent, wait for 'goadmin' to read it, which will trigger the execution of the injected script.