MyNET Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in MyNET versions through 26.05. This issue allows unauthenticated users to inject malicious scripts via the 'msg' parameter, due to inadequate input validation and output encoding. The vulnerability was discovered by André Monteiro and Miguel Santareno.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a request to the application with a payload in the 'msg' parameter that includes a script injection, such as a JavaScript alert command. This can be done by crafting a URL that contains the malicious payload in the 'msg' parameter and then accessing that URL.

Remediation

Users are advised to update to MyNET version 26.06 or later, where this vulnerability has been fixed.