[SECURITY] Persistent Cross-Site Scripting (XSS)

[JavierOlmedo]

Hi,

dashboard_name parameter is vulnerable to Persistent Cross-Site Scripting attacks through POST requests in /ajax_form.php resource.

This vulnerability, allow remote attackers to inject arbitrary web script or HTML.

Proof of concept (PoC)
Click in New Dashboard (+) and enter payload "<script>alert('XSS PoC')</script>" in name field

Greetings!

[laf]

@JavierOlmedo Thanks for the report.

Please note for future reference that we ask people to contact us via email for security related issues: https://docs.librenms.org/#General/Security/ and that GitHub isn't used for reporting any form of bugs or security issues.