Skip to content

Instantly share code, notes, and snippets.

@ArtemBrylev

ArtemBrylev/CVE-2021-28109

Created March 17, 2021 13:50
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save ArtemBrylev/51106b7cf8929b3ecfb9dd7c9e7b0fcf to your computer and use it in GitHub Desktop.
Save ArtemBrylev/51106b7cf8929b3ecfb9dd7c9e7b0fcf to your computer and use it in GitHub Desktop.
Download ZIP
Raw
CVE-2021-28109
CVE-2021-28109
------------------------------------------
TranzWare (POI) FIMI before 4.2.20.4.2 had an XSS vulnerability that was fixed with a notification sent to all customers using TranzWare (POI) FIMI.
------------------------------------------
[Additional Information]
During penetration testing of our clients' infrastructure, we discovered vulnerabilities in a third-party software - TranzWare (POI) FIMI v.4.2.17.5.
We contacted the Software Development Company to disclose the vulnerabilities. The Company confirmed that the vulnerabilities had been fixed and the patched software had been released.
We found a vulnerability that can lead to a reflected Cross-Site Scripting (XSS) attack.
The web application TranzWare (POI) FIMI v.4.2.17.5 uses a part of URL to build a web page login_tw.php without proper sanitization.
------------------------------------------
[VulnerabilityType Other]
Fixed with a notification sent to all customers using TranzWare (POI) FIMI.
------------------------------------------
[Vendor of Product]
Compass Plus Ltd.
------------------------------------------
[Affected Product Code Base]
TranzWare (POI) FIMI before 4.2.20.4.2
------------------------------------------
[Has vendor confirmed or acknowledged the vulnerability?]
true
------------------------------------------
[Affected Component]
login_tw.php
-----------------------------------------
[Attack Type]
Remote
------------------------------------------
[Discoverer]
Artem Brylev (https://twitter.com/ArtyomBrylev)
Deiteriy Co. Ltd. (https://deiteriylab.com/)
------------------------------------------
[Reference]
Compass Plus Ltd. (https://compassplus.com/)
Artem Brylev / Deiteriy Co. Ltd. (https://deiteriylab.com/)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment