LigeroSmart Cross-Site Scripting Vulnerability in AgentDashboard Function

A reflected cross-site scripting (XSS) vulnerability has been identified in LigeroSmart versions through 6.1.26. The issue resides in the AgentDashboard function of the file /otrs/index.pl, where the Subaction parameter is not properly validated or encoded. This flaw allows for the injection of arbitrary JavaScript, which is executed in the context of the user's browser. The vulnerability can be exploited remotely, but requires user interaction.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where injected scripts are executed in the context of the victim's browser.

Reproduction

To reproduce this vulnerability, send a POST request to /otrs/index.pl with the Subaction parameter manipulated to include a script tag. This can be done by injecting JavaScript code, such as an alert, which will be executed once the response is received.