Multiple persistent input validation web vulnerabilities are detected in the Enterpriser16 v7.1 Load Balancer Application. The bug allows remote attackers to implement/inject own malicious script code on the application side (persistent) of the service.
The first vulnerabilities are located in the `Edit Configuration` module with the bound vulnerable Label, Virtual Host, Request to send, Email Alerts and Response expected parameters.
The secound vulnerabilities are located in the Create Solution, Access points and New Contract module with the bound vulnerable title, asset name, contract name, name or description parameter requests.
Exploitation requires low user interaction and a low privileged application user account. Successful exploitation of the vulnerability can lead to persistent session hijacking (manager/admin), persistent phishing or persistent module web context manipulation.
Proof of Concept:
The persistent input validation vulnerability can be exploited by remote attackers with low required user interaction & low privileged user account. For demonstration or reproduce ...
<p class="error">
Error:
<em>
Input field failed the validation.
<br>
'">
<iframe [PERSISTENT INJECTED SCRIPT CODE!]>
' is not a valid IP address.
</em>
</p>
