PT-2018-12566 · Xiao5Ucompany · Feedback.Asp+2

Published 2018-07-23 · Updated 2018-09-18 · CVE-2018-14527

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Xiao5uCompany version 1.7

Description The issue arises from an insufficient XSS protection mechanism in Safe.asp, which fails to consider certain elements such as VIDEO, in addition to properly handling SCRIPT and IMG elements. This oversight can lead to XSS attacks.

Recommendations For version 1.7, update the Safe.asp file to include proper validation and sanitization of all elements, including VIDEO, to prevent XSS attacks. As a temporary workaround, consider disabling the Feedback.asp page until a patch is available. Restrict access to the Feedback.asp page to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-14527

Affected Products

Feedback.Asp

Safe.Asp

Xiao5Ucompany

References · 3

• 🔥 https://github.com/WhiteRabbitc/WhiteRabbitc.github.io/blob/master/2018/Xiao5uCompany_1.7_xss.doc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-14527 · Security Note
• https://osv.dev/vulnerability/CVE-2018-14527 · Vendor Advisory