CVE-2020-28415 PoC — Compassplus TranzWare Payment Gateway 跨站脚本漏洞

Source

https://github.com/jet-pentest/CVE-2020-28415

Associated Vulnerability

Title: Compassplus TranzWare Payment Gateway 跨站脚本漏洞 (CVE-2020-28415)
Description:A reflected cross-site scripting (XSS) vulnerability exists in the TranzWare Payment Gateway 3.1.12.3.2. A remote unauthenticated attacker is able to execute arbitrary HTML code via crafted url (different vector than CVE-2020-28414).

Readme

# CVE-2020-28415

## [Suggested description]
A reflected cross-site scripting (XSS) vulnerability exists in the TranzWare Payment Gateway 3.1.12.3.2. A remote unauthenticated attacker is able to execute arbitrary HTML code via crafted url (different vector than CVE-2020-28414).

## [Vulnerability Type]
Cross Site Scripting (XSS)

## [Vendor of Product]
TranzWare

## [Affected Product Code Base]
Payment Gateway 3.1.12.3.2.

## [Attack Type]
Remote

## [Impact Code execution]
true

## [Has vendor confirmed or acknowledged the vulnerability?]
true

## [Reference]
https://compassplus.com/solutions/tranzware/

## [Discoverer]
Vladimir Rotanov (Jet Infosystems (jet.su), Moscow, Russia)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →