Description
Sony BRAVIA Digital Signage 1.7.8 contains a remote file inclusion vulnerability that allows attackers to inject arbitrary client-side scripts through the content material URL parameter. Attackers can exploit this vulnerability to hijack user sessions, execute cross-site scripting code, and modify display content by manipulating the input material type.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Pro-Bravia | Sony BRAVIA Digital Signage | ≤ 1.7.8 | — |
References
- ExploitDB-49186 exploit
- Sony BRAVIA Digital Signage Product Homepage product
- BRAVIA Signage Software Resources product
- Sony Professional Display Software Product Page product
- Zero Science Lab Disclosure (ZSL-2020-5612) third-party-advisory
- Packet Storm Security Exploit Archive exploit
- IBM X-Force Exchange Vulnerability Entry vdb-entry
- CXSecurity Vulnerability Listing exploit
- VulnCheck Advisory: Sony BRAVIA Digital Signage 1.7.8 Unauthenticated Remote File Inclusion third-party-advisory