PT-2021-20146 · Onyaktech · Onyaktech Comments Pro

Burninator · Published 2021-09-07 · Updated 2021-09-13 · CVE-2021-33483

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OnyakTech Comments Pro version 3.8

Description An issue in CommentsService.ashx allows an attacker to add an XSS payload to the JSON request, which will execute when users visit the page with the comment. This affects the comment posting functionality.

Recommendations For OnyakTech Comments Pro version 3.8, consider disabling the comment posting functionality in CommentsService.ashx until a patch is available to prevent the addition of XSS payloads to JSON requests.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-33483

Affected Products

Onyaktech Comments Pro

References · 5

• 🔥 https://burninatorsec.blogspot.com/2021/07/onyaktech-comments-pro-broken.html · Exploit
• https://osv.dev/vulnerability/CVE-2021-33483 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33483 · Security Note
• https://t.me/cibsecurity/28310 · Telegram Post
• https://twitter.com/onyaktech · Note