关键漏洞信息 漏洞概要 标题: AVE DOMINAprlus <=1.10.x CSRF/XSS Vulnerabilities 公告ID: ZSL-2019-5547 类型: Local/Remote 影响: Cross-Site Scripting 风险: 4/5 发布日期: 27.12.2019 供应商 AVE S.p.A. 网站: https://www.ave.it 受影响版本 Web Server Code 53AB-WBS - 1.10.62 Touch Screen Code TS01 - 1.0.65 Touch Screen Code TS03x-V Touch Screen Code TS05 - 1.10.36 Models: 53AB-WBS, TS01, TS03V, TS04X-V, TS05N-V App versions: 1.10.77, 1.10.65, 1.10.64, 1.10.62, 1.10.60, 1.10.52, 1.10.52A, 1.10.49, 1.10.46, 1.10.45, 1.10.44, 1.10.35, 1.10.25, 1.10.22, 1.10.11, 1.8.4, TS1-1.0.65, TS1-1.0.62, TS1-1.0.44, TS1-1.0.10, TS1-1.0.9 测试环境 GNU/Linux 4.1.19-armv7-x7 GNU/Linux 3.8.13-bone50/bone71.1/bone86 Apache/2.4.7 (Ubuntu) Apache/2.2.22 (Debian) PHP/5.5.9-1ubuntu4.23 PHP/5.4.41-0+deb7u1 PHP/5.4.36-0+deb7u3 供应商状态 [06.10.2019] 漏洞被发现 [14.10.2019] 供应商已联系 [20.10.2019] 未收到供应商回复 [21.10.2019] 再次联系供应商 [26.12.2019] 未收到供应商回复 [27.12.2019] 公开发布安全公告 PoC dominaplus_csrfxss.txt 参考文献 1. https://packetstormsecurity.com/files/155760 2. https://www.exploit-db.com/exploits/47821 3. https://exchange.xforce.ibmcloud.com/vulnerabilities/173629 4. https://exchange.xforce.ibmcloud.com/vulnerabilities/173618 5. https://cxsecurity.com/issue/WLB-2019120115 6. https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-21988