# Title: AvantFAX 3.3.3 - XSS # Author: Nassim Asrir # Contact: wassline@gmail.com # Vendor: https://www.officetracker.com/ # CVE: CVE-2017-18024 # Description AvantFAX 3.3.3 has XSS via an arbitrary parameter name to the default URI, as demonstrated by a parameter whose name contains a SCRIPT element and whose value is 1. ------------------------------------------ # Details The name of an arbitrarily supplied body parameter is copied into the HTML document as plain text between tags. The payload jlbqg