Huashengdun WebSSH Cross-Site Scripting Vulnerability in Login Page

A reflected cross-site scripting vulnerability has been identified in Huashengdun WebSSH versions through 1.6.2. The issue arises in the Login Page component, where the hostname/port argument can be manipulated to inject malicious scripts. This vulnerability can be exploited remotely, with the injected script executing in the context of the user's browser.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject and execute malicious scripts in the context of the victim's browser. This could lead to session hijacking, data theft, or other malicious actions.

Reproduction

To reproduce this vulnerability, send a request to the WebSSH application with a crafted URL that includes a script tag in the port parameter. The application will reflect the script back in the response, executing it in the user's browser.