AVTECH DGM1104 Stored Cross-Site Scripting Vulnerability in PwdGrp.cgi Endpoint

A stored cross-site scripting vulnerability has been identified in the PwdGrp.cgi endpoint of the AVTECH DGM1104 camera model. This vulnerability allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the username field. The issue arises in the user creation functionality of the admin interface, where injected scripts are executed when the user list page is accessed.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the affected page.

Reproduction

To reproduce this vulnerability, log into the admin interface of an affected AVTECH DGM1104 camera. Navigate to the user creation section and enter a username that includes HTML or JavaScript payloads. Once the user is created, the injected script will execute when the user list page is visited.