medium6.1Public exploit code
CVE-2021-31682
The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains a vulnerability that allows for reflected XSS attacks due to the operator…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- WebCTRL OEM 6.5 - 'locale' Reflected Cross-Site Scripting (XSS)2021-10-29 · webapps · multiple
Impact
The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains a vulnerability that allows for reflected XSS attacks due to the operatorlocale GET parameter not being sanitized. This issue impacts versions 6.5 and below. This issue works by passing in a basic XSS payload to a vulnerable GET parameter that is reflected in the output without sanitization.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Automatedlogic | Webctrl | through 6.5 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/164707/WebCTRL-OEM-6.5-Cross-Site-Scripting.html
- https://github.com/3ndG4me/WebCTRL-OperatorLocale-Parameter-Reflected-XSS
- https://www.automatedlogic.com/en/products-services/webctrl-building-automation-system/
- http://packetstormsecurity.com/files/164707/WebCTRL-OEM-6.5-Cross-Site-Scripting.html
- https://github.com/3ndG4me/WebCTRL-OperatorLocale-Parameter-Reflected-XSS
- https://www.automatedlogic.com/en/products-services/webctrl-building-automation-system/