Multiple cross-site scripting vulnerabilities in Smoothwall Express 3.1 enable attackers to execute malicious scripts in the context of a user session, posing a significant risk of account compromise.

The application suffers from multiple stored and reflected cross-site scripting (XSS) flaws within CGI-based endpoints, including urlfilter.cgi, proxy.cgi, and dhcp.cgi. These vulnerabilities allow unauthenticated attackers to inject malicious JavaScript payloads via HTTP POST requests, which are subsequently executed in the victim's browser.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of an administrator or user session. This can lead to the theft of session cookies, unauthorized administrative actions, or the redirection of users to malicious content, severely impacting the integrity and confidentiality of the firewall management interface. The CVSS score of 7.2 reflects the high potential for impact on the management of network security infrastructure.

Immediate Action: Since no official patch is currently available, organizations should restrict access to the web-based management interface to trusted administrative networks only.

Proactive Monitoring: Review web access logs for suspicious POST requests containing script tags or encoded characters directed toward .cgi files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect and block malicious script injections in HTTP POST parameters.

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the Exploit-DB entry 46333.

Given the availability of public proof-of-concept code and the critical role of firewall management interfaces, this vulnerability must be treated with urgency. Administrators should apply network-level access controls immediately to prevent unauthorized access to the web interface, as there is currently no vendor-provided patch to remediate the underlying code flaws.