CVE-2026-27176
📋 TL;DR
MajorDoMo's command.php has a reflected XSS vulnerability where the $qry parameter is directly inserted into HTML without sanitization. Attackers can craft malicious URLs to execute arbitrary JavaScript in victims' browsers. All MajorDoMo instances using vulnerable versions are affected.
💻 Affected Systems
- MajorDoMo (Major Domestic Module)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal session cookies, hijack user accounts, perform actions as authenticated users, or redirect to malicious sites.
Likely Case
Session hijacking, credential theft, or defacement of the web interface through crafted phishing links.
If Mitigated
Limited impact if input validation, output encoding, or WAF rules block malicious payloads.
🎯 Exploit Status
Exploitation requires user interaction (clicking malicious link). Proof-of-concept details are publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version including pull request #1177
Vendor Advisory: https://github.com/sergejey/majordomo/pull/1177
Restart Required: No
Instructions:
1. Update MajorDoMo to version including pull request #1177. 2. Apply the patch that adds htmlspecialchars() to sanitize $qry parameter output. 3. No restart needed for PHP changes.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to reject or sanitize malicious qry parameter values before processing.
Modify command.php to validate $qry parameter using regex or whitelist allowed characters.
WAF Rule
allDeploy Web Application Firewall rules to block requests containing JavaScript in qry parameter.
🧯 If You Can't Patch
- Restrict access to command.php using network ACLs or authentication.
- Implement Content Security Policy (CSP) headers to mitigate XSS impact.
🔍 How to Verify
Check if Vulnerable:
Test by accessing command.php with qry parameter containing <script>alert('XSS')</script> and check if script executes.Check Version:
Check MajorDoMo version in admin interface or review source code for htmlspecialchars() usage in command.php.Verify Fix Applied:
After patching, repeat the test; script should not execute and special characters should be HTML-encoded.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to command.php with qry parameter containing script tags or JavaScript code.
Network Indicators:
- Unusual spikes in requests to command.php with long or encoded parameters.
SIEM Query:
source="web_logs" AND uri="*command.php*" AND query="*qry=*script*"