[ 0day (xc) Our ] Pew Pew 0day MikroTik RouterOS Cross Site Scripting 2025 Code by skraito with skraitow … . Have Fun Patching it … .

Exploit Title: MikroTik RouterOS < v7 – Reflected Cross-Site Scripting (XSS) in UserManager Web Interface
Google Dork: N/A (UserManager interface is typically not publicly exposed)
Date: 2025-07-03
Author: Ahmed Mutaher
Vendor Homepage: https://mikrotik.com/
Software Link: https://mikrotik.com/download
Version: All versions prior to v7.0
Tested on:

• RB1100AHx4 (v6.48.2)
• RB750GL (v6.39)
• CCR1009-8G-1S-1S+ (v6.41)
• x86 (v5.20, v6.49.18)
  CVE: N/A Description:
  A reflected cross-site scripting (XSS) vulnerability exists in MikroTik RouterOS versions prior to v7,
  specifically in the UserManager web interface. This flaw can be exploited by unauthenticated attackers,
  allowing JavaScript injection via a specially crafted URL without requiring a valid login session. During analysis of the source code of the /userman page, it was discovered that the application attempts
  to mitigate input by discarding any content after the double slash (//). However, by repeating the payload
  and crafting it carefully, this behavior can be bypassed and JavaScript can be executed in the browser context. Vulnerable Endpoint:
  http:///userman/’,true);alert(‘XSS’);//’,true);alert(‘XSS’);// Proof of Concept (PoC):
  Payload:
  http://192.168.88.1/userman/’,true);alert(‘XSS’);//’,true);alert(‘XSS’);// Steps to Reproduce:

1. Open the target RouterOS UserManager URL in a browser without logging in.
2. Inspect the page source and identify the reflected input behavior.
3. Notice that the system strips content after //.
4. Craft the payload to repeat the malicious code to bypass the filtering.
5. When the payload is executed, an alert box is triggered, proving the XSS vulnerability. Impact:

• JavaScript execution without authentication.
• Possible phishing or redirection attacks.
• Can be used as part of a social engineering chain to trick admins or users. Mitigation:
• Sanitize all user input using context-aware encoding (e.g., htmlspecialchars()).
• Implement Content Security Policy (CSP).
• Avoid reflecting unsanitized GET parameters in HTML or JavaScript contexts.