# Exploit Title: Stored XSS in service_alias parameter in Centreon version 22.04.0 # Date: 1/10/2022 # Exploit Author: syad # Vendor Homepage: Centreon # Software Link: https://download.centreon.com/ # Version: 22.04.0 # CVE ID : CVE-2022-39988 # Tested on: Centos 7 Centreon 22.04.0 is vulnerable to Stored Cross Site Scripting (XSS) from the function Service -> Templates -> by adding a crafted payload into the service_alias parameter. go to this endpoint -> /centreon/main.get.php?p=60206 -> Service -> Templates -> Click Button "Add" and put the crafted payload below on section "Alias" and save payload --> test">