GestioIP Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in GestioIP version 3.5.7. The issue arises in the 'ip_mod_dns_key_form.cgi' request, where an attacker can inject malicious code into the 'TSIG Key' field. This injected code is saved in the database and executed when the data is viewed, potentially leading to data exfiltration and allowing cross-site request forgery attacks.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the data. This could also facilitate cross-site request forgery attacks.

Reproduction

To reproduce this vulnerability, log into GestioIP version 3.5.7 and navigate to the DNS key management section. Inject a script into the 'TSIG Key' field of the 'ip_mod_dns_key_form.cgi' request. Once the injection is saved, the script will execute when the key is viewed, demonstrating the cross-site scripting vulnerability.