Pnetlab Cross-Site Scripting Vulnerability

A Cross-Site Scripting (XSS) vulnerability exists in Pnetlab version 5.3.11. This issue allows attackers to inject malicious scripts into web pages, which are then executed in the context of the victim's browser. The vulnerability can be exploited by manipulating the 'success' parameter in the URL, particularly after registration, which triggers an application error message that executes the injected script.

Impact

Exploitation of this vulnerability allows for Cross-Site Scripting, where injected scripts are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, install PNETLab version 5.3.11 on VMware. After registration, the application redirects to the login page. The 'success' parameter in the URL can be manipulated by injecting a script, such as an alert, which will be executed once the page is loaded.