CVE-2021-21803 PoC — Advantech R-SeeNet 跨站脚本漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21803.yaml

Associated Vulnerability

Title:Advantech R-SeeNet 跨站脚本漏洞 (CVE-2021-21803)
Description:Advantech R-SeeNet是中国台湾研华（Advantech）公司的一个工业监控软件。该软件基于 snmp 协议进行监控平台，并且适用于 Linux、Windows 平台。 Advantech R-SeeNet v2.4.12(20.10.2020)的 device_graph_page.php 脚本功能中存在跨站脚本漏洞。如果用户访问特制的 URL，可能会导致在目标用户浏览器的上下文中执行任意 JavaScript 代码。

Description

Advantech R-SeeNet is vulnerable to cross-site scripting via the device_graph_page.php script via the is2sim parameter. A specially crafted URL by an attacker and visited by a victim can lead to arbitrary JavaScript code execution.

File Snapshot


 id: CVE-2021-21803

info:
  name: Advantech R-SeeNet - Cross-Site Scripting
  author: gy741
  severi

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!