ARD Ajax Transaction Manager Endpoint Cross-Site Scripting Vulnerability

A Cross-Site Scripting (XSS) vulnerability exists in the Ajax transaction manager endpoint of ARD. This issue allows an attacker to intercept the Ajax response and inject malicious JavaScript into the accountName field. The injected script is executed in the context of the user's browser, as the input is not properly sanitized or encoded before rendering. This vulnerability could result in session hijacking, cookie theft, and other malicious activities.

Impact

Exploitation of this vulnerability allows for Cross-Site Scripting, where injected scripts are executed in the context of the user's browser. This could lead to session hijacking, theft of cookies, and other malicious actions.

Reproduction

To reproduce this vulnerability, intercept the Ajax response to the transaction manager endpoint. Inject malicious JavaScript into the accountName field. Once the response is rendered, the injected script will execute in the user's browser.