Micronet SP1910 Data Access Controller UI - Cross-Site Scripting / HTML Code Injection

ExploitDBExploitDB exploitStubEDB-10247

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact describes an XSS vulnerability in the Micronet SP1910 UI and provides a single example URL with a script tag injected into the 'msg' parameter. It does not contain any functional exploit code, scanner logic, or a substantive technical writeup. The content is limited to a brief description and a non-executable proof-of-concept URL, making it a stub.

Backdoor review

No backdoor observed in reviewed code

The artifact is a plain-text Proof-of-Concept (PoC) describing a reflected Cross-Site Scripting (XSS) vulnerability in the Micronet SP1910 UI. It contains no executable code, no obfuscated payloads, and no instructions for the reviewer to perform any action beyond viewing the example URL. The PoC simply demonstrates injecting a benign <script>alert('xss')</script> payload into a vulnerable parameter.

ClassificationStub
Model confidence95%
AuthenticationUnknown
LanguagesEnglish
Target softwareMicronet SP1910 Network Access Controller
Attack typescross-site scripting (XSS)
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains only a description of the vulnerability and a single non-executable URL example. It lacks functional exploit code, scanner logic, or a detailed technical analysis, fitting the definition of a stub.

exploits/hardware/webapps/10247.txt:1-22

Requirements

  • The attacker must be able to craft a URL with a malicious script in the 'msg' parameter and deliver it to a victim.exploits/hardware/webapps/10247.txt:22

Observed behavior

  • The provided URL includes a script tag that would execute an alert if the parameter is reflected without sanitization.exploits/hardware/webapps/10247.txt:22
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url
http://server/loginpages/error_user.shtml?uname=userid&msg=<script>alert('xss')</script>Example URL demonstrating the XSS vulnerability by injecting a benign alert script into the 'msg' parameter.exploits/hardware/webapps/10247.txt:22
Review boundaries

What the analysis did not establish

  • The artifact is a single text file with no executable code; the provided URL is a static example and not a functional exploit or scanner.
  • Review is limited to the supplied text file; no external resources referenced in the file (e.g., vendor URL) were fetched or analyzed.
  • The artifact is a PoC for a web application vulnerability; the benign nature of the example payload does not guarantee the safety of the live target if tested.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1