ETAP Safety Manager 1.0.0.32 Cross Site Scripting

ETAP Safety Manager 1.0.0.32 Remote Unauthenticated Reflected XSSVendor: ETAP Lighting International NVProduct web page: https://www.etaplighting.comAffected version: 1.0.0.32Summary: The ETAP Safety Manager (ESM) is a central managing and controlsystem that helps you to monitor, adjust and maintain your emergency lightingsystem. Therefore each luminaire connected to your ESM network is given aunique code. The ESM can easily identify the luminaires individually andautomatically report whether all luminaires work properly. You can eitherchoose between a wired or wireless network, or a combination of both. WithESM you will not only manage your self contained or your centrally supplied‘ETAP Battery System’ (EBS) emergency luminaires’, but also DALI emergencyunits and K9 LED modules, which you can build into your luminaires. Sinceyour ESM system is connected to the Internet, you will always have accessto it through the World Wide Web. ESMweb™ is an ‘embedded web server’application for monitoring an emergency lighting system, which runs in the‘ESM web controller’. The ESMweb™ application can be accessed from any PCin the corporate network or connected to the Internet - by a standard webbrowser.Desc: Input passed to the GET parameter 'action' is not properly sanitisedbefore being returned to the user. This can be exploited to execute arbitraryHTML/JS code in a user's browser session in context of an affected site.Tested on: Apache/2.4.41 (Ubuntu)Vulnerability discovered by Gjoko 'LiquidWorm' Krstic                            @zeroscienceAdvisory ID: ZSL-2022-5711Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5711.php22.08.2022--PoC:GET /json/authenticate.php?action=[XSS]&username=waddup&password=nm HTTP/1.1{"success":false,"errorMessage":"Invalid command: $","errorCode":0,"errorInfo":"\/var\/www\/etap-root\/scripts\/class.dispatch.php(39)","rows":[]}