# Exploit Title: eGain Chat 15.5.5 Cross-Site Scripting  
# Vendor Homepage:  
# Software Link:  
# Exploit Authors: Brandon Ming Yang Ho (, Hassy Vinod Eshan (  
# CVE: CVE-2020-15948  
# Timeline  
- June 2020: Initial vulnerability discovery  
- July 2020: Reported to eGain Corporation  
- August 2020: Fix/patch provided by eGain Corporation  
- September 2020: Public disclosure notified to eGain Corporation  
- July 2021: Published CVE-2020-15948  
# 1. Introduction  
eGain Chat is a real time chat assistance solution by eGain Corporation for website visitors to communicate with chat agents.  
# 2. Vulnerability Details  
eGain Chat version 15.5.5 is vulnerable to reflected Cross-Site Scripting (Reflected XSS).  
The β€œName” input field (full_name) does not fully sanitise user input for special characters such as β€œ<” or β€œ>” and HTML attributes such as β€œ<a href>”. It is possible for an attacker to bypass filtering and create malicious scripts. Once the response has been rendered, the malicious JavaScript code would be executed.  
# 3. Proof of Concept  
The β€œName” input field (full_name) of the chat window can be injected with the following XSS payload as a Proof of Concept to execute a javascript alert popup.  
Payload - <a href="javascript&#58alert(document.domain)">click</a>  
# 4. Remediation  
Apply the latest fix/patch from eGain Corporation.  
# 5. Credits  
- Brandon Ming Yang Ho (  
- Hassy Vinod Eshan (