# Technical Details

## Vulnerable Endpoint

- `customer.pl`

## Vulnerable Input Surface

The issue is associated with the parameter defined by the Znuny configuration key `CustomerPanelSessionName`.

In observed deployments, this parameter may appear as:

- `OTRSCustomerInterface`

However, `OTRSCustomerInterface` is not a universal literal value. It depends on the system configuration.

## Vulnerability Type

- Reflected Cross-Site Scripting (XSS)
- HTML Injection

## Attack Preconditions

- No authentication required
- Public access to the customer-facing interface
- Crafted GET request

## Observed Behavior

Attacker-controlled input is reflected in the HTTP response in a way that may permit HTML injection and JavaScript execution in the browser.

This can enable:

- JavaScript execution in the victim browser
- user interface manipulation
- deceptive content injection
- phishing-style workflows
- user redirection

## Security Relevance

Because the vulnerable surface is the public customer interface, exploitation may affect unauthenticated users who interact with a crafted link or attacker-controlled request.

## Version Validation Note

This public repository distinguishes between:

- versions confirmed in a controlled testing environment, and
- versions observed during real-world research on publicly exposed third-party instances.

Specific third-party targets are intentionally omitted from publication.

## Publication Scope

This advisory intentionally omits a public target list and a fully weaponized payload set.

The publication is focused on:

- vulnerability documentation
- coordinated disclosure record
- affected/fixed version tracking
- high-level technical characterization
