MyNET Iframe Injection Vulnerability Allowing Arbitrary Code Execution

A vulnerability allowing iframe injection has been identified in MyNET versions 26.06 and prior. This issue arises from inadequate input validation and output encoding, enabling remote attackers to execute arbitrary code by manipulating the src parameter. The vulnerability affects users who interact with the compromised iframe, as the injected content can be used to execute malicious actions on their behalf.

Impact

Exploitation of this vulnerability could lead to arbitrary code execution on the victim's machine.

Reproduction

To reproduce this vulnerability, send a link to the victim that includes a payload in the src parameter. For example, the link could point to a responsive page with a src parameter set to an external site, such as Google.

Remediation

Users are advised to update to MyNET version 26.08 or later, where this vulnerability has been addressed.