MyNET Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in MyNET versions prior to 26.08.316. The issue arises in the msgtipo parameter, allowing unauthenticated users to inject malicious scripts due to inadequate input validation and output encoding. This vulnerability can be exploited by sending a crafted link that includes the malicious payload in the msgtipo parameter.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a link to the victim that includes a payload in the msgtipo parameter. The payload can be crafted to include JavaScript, such as an alert box displaying the document's domain, which demonstrates the execution of the injected script.

Remediation

Users are advised to update to MyNET version 26.08.316 or later, where this vulnerability has been fixed.