CVE-2020-28415 PoC — Compassplus TranzWare Payment Gateway 跨站脚本漏洞

介绍

# CVE-2020-28415

## [Suggested description]
A reflected cross-site scripting (XSS) vulnerability exists in the TranzWare Payment Gateway 3.1.12.3.2. A remote unauthenticated attacker is able to execute arbitrary HTML code via crafted url (different vector than CVE-2020-28414).

## [Vulnerability Type]
Cross Site Scripting (XSS)

## [Vendor of Product]
TranzWare

## [Affected Product Code Base]
Payment Gateway 3.1.12.3.2.

## [Attack Type]
Remote

## [Impact Code execution]
true

## [Has vendor confirmed or acknowledged the vulnerability?]
true

## [Reference]
https://compassplus.com/solutions/tranzware/

## [Discoverer]
Vladimir Rotanov (Jet Infosystems (jet.su), Moscow, Russia)

文件快照

备注