Machsol MachPanel Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in Machsol MachPanel version 8.0.32. This issue allows attackers to execute arbitrary web scripts or HTML by uploading a crafted PDF file that contains malicious metadata. The vulnerability can be exploited by navigating to the 'Submit Ticket' page, uploading the PDF with the XSS payload, and then accessing the uploaded file to execute the script.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can execute scripts in the context of the user's browser.

Reproduction

To reproduce this vulnerability, upload a PDF file containing XSS scripts in the metadata to the 'Submit Ticket' page. After submitting the ticket, the malicious script can be executed by accessing the uploaded file.