Chris92de AdminServ adminserv.php cross site scripting

Successful exploitation of CVE-2020-36638 allows an attacker to inject arbitrary JavaScript code into the AdminServ application. This code can then be executed in the context of a user's browser, potentially enabling the attacker to steal session cookies, redirect users to malicious websites, or deface the application. Given the XSS nature, the impact is primarily focused on user accounts with access to the vulnerable AdminServ interface. The lack of ongoing support increases the risk, as no further security updates are expected, leaving systems vulnerable to exploitation.

Systems running Chris92de AdminServ that are still in use, despite the product being unsupported, are at significant risk. This includes organizations that may have inherited legacy systems or are using the software in non-critical environments without realizing the security implications. Shared hosting environments where AdminServ is installed pose a particular risk, as vulnerabilities can affect multiple users.

• php: Examine the resources/core/adminserv.php file for the presence of the patch 9a45087814295de6fb3a3fe38f96293665234da1.

find /path/to/adminserv/ -name "adminserv.php" -print0 | xargs -0 grep -i '9a45087814295de6fb3a3fe38f96293665234da1'

• generic web: Monitor access logs for unusual requests targeting resources/core/adminserv.php with potentially malicious parameters.

grep "error=" /path/to/access.log

1. 2022-12-30Disclosure

   disclosure

1. Réservé2022-12-30
2. Publiée2022-12-30
3. Modifiée2024-08-04
4. EPSS mis à jour2026-04-02

The primary mitigation for CVE-2020-36638 is to apply the patch 9a45087814295de6fb3a3fe38f96293665234da1. Since the product is no longer supported, applying this patch may require manual intervention and careful testing to ensure compatibility with the existing environment. As a temporary workaround, consider implementing strict input validation and output encoding on all user-supplied data processed by adminserv.php. Web application firewalls (WAFs) configured to detect and block XSS payloads can also provide a layer of defense, although they are not a substitute for patching. Verify the patch application by attempting to trigger the XSS vulnerability after applying the fix; the injected script should not execute.