CVE-2021-31682
MEDIUM NUCLEIAutomated Logic WebCTRL < 6.5 - Reflected Cross-Site Scripting via operatorlocale Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2021-31682. PoCs published by 3ndG4me. A Nuclei detection template is also available.
AI-analyzed exploit summary The exploit describes a reflected XSS vulnerability in WebCTRL OEM 6.5 and below, where the 'operatorlocale' GET parameter is not sanitized, allowing arbitrary JavaScript execution. The PoC demonstrates this via a crafted URL with an embedded script tag.
Description
The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains a vulnerability that allows for reflected XSS attacks due to the operatorlocale GET parameter not being sanitized. This issue impacts versions 6.5 and below. This issue works by passing in a basic XSS payload to a vulnerable GET parameter that is reflected in the output without sanitization.
Exploits (1)
The exploit describes a reflected XSS vulnerability in WebCTRL OEM 6.5 and below, where the 'operatorlocale' GET parameter is not sanitized, allowing arbitrary JavaScript execution. The PoC demonstrates this via a crafted URL with an embedded script tag.
Nuclei Templates (1)
html:"/_common/lvl5/dologin.jsp" || http.html:"/_common/lvl5/dologin.jsp"
body="/_common/lvl5/dologin.jsp"
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N