MajorDoMo shoutbox allows attackers to steal admin session

Summary

The MajorDoMo shoutbox is vulnerable to a security threat that allows attackers to steal sensitive information from administrators. This can happen when an attacker injects malicious code into the shoutbox, which is then executed when an admin logs in. To stay safe, update MajorDoMo to the latest version and ensure all admins use strong passwords and keep their sessions secure.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
mjdm	majordomo	All versions	–

Original title

MajorDoMo (aka Major Domestic Module) contains a stored cross-site scripting (XSS) vulnerability through method parameter injection into the shoutbox. The /objects/?method= endpoint allows unauthen...

Original description

MajorDoMo (aka Major Domestic Module) contains a stored cross-site scripting (XSS) vulnerability through method parameter injection into the shoutbox. The /objects/?method= endpoint allows unauthenticated execution of stored methods with attacker-controlled parameters. Default methods such as ThisComputer.VolumeLevelChanged pass the user-supplied VALUE parameter directly into the say() function, which stores the message raw in the shouts database table without escaping. The shoutbox widget renders stored messages without sanitization in both PHP rendering code and HTML templates. Because the dashboard widget auto-refreshes every 3 seconds, the injected script executes automatically when any administrator loads the dashboard, enabling session hijack through cookie exfiltration.

nvd CVSS3.1 6.1

nvd CVSS4.0 5.3

Vulnerability type

CWE-79 Cross-site Scripting (XSS)

https://chocapikk.com/posts/2026/majordomo-revisited/ Third Party Advisory Exploit
https://github.com/sergejey/majordomo/pull/1177 Issue Tracking Exploit
https://www.vulncheck.com/advisories/majordomo-stored-cross-site-scripting-via-m... Third Party Advisory