Sytel Softdial Contact Center Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Softdial Contact Center by Sytel Ltd. This issue allows attackers to upload XML files containing injected JavaScript code through the '/softdial/scheduler/save.php' resource. The malicious code executes when the file is loaded via '/softdial/scheduler/load.php', potentially redirecting victims to harmful sites or stealing their login credentials to impersonate them.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.