COMMAX Biometric Access Control System Cookie Reflected XSS (ZSL-2021-5660)

Key Information Summary Vulnerability Overview Title: COMMAX Biometric Access Control System 1.0.0 Cookie Reflected XSS Advisory ID: ZSL-2021-5660 Type: Local/Remote Impact: Cross-Site Scripting (XSS) Risk: (3/5) Release Date: 15.08.2021 Vulnerability Description Summary: The biometric access control system is vulnerable to an unauthenticated reflected Cross-Site Scripting (XSS) attack. Input for the CMX_ADMIN_NM and CMX_COMPLEX_NM cookies is not properly sanitized and is directly echoed back to the user, potentially allowing injection of arbitrary HTML and JavaScript code, which could be exploited to compromise user sessions on the affected website. Technical Parameters Vendor: COMMAX Co., Ltd. - https://www.commax.com Affected Version: 1.0.0 Test Environment: nginx/1.14.0 (Ubuntu), MariaDB/10.3.15 Vendor Status Discovery Date: [02.08.2021] Vulnerability discovered Final Release: [15.08.2021] Public security advisory released PoC Reference PoC Link: commax_xss.txt Acknowledgments Discoverer: Gjoko Krstic - References [1] https://packetstormsecurity.com/files/163834 [2] https://exchange.xforce.ibmcloud.com/vulnerabilities/207578 [3] https://cxcsecurity.com/issue/WLB-2021080063 Change Log [15.08.2021] - Initial release [23.08.2021] - Added references [1], [2], and [3] Contact Zero Science Lab - Website: https://www.zeroscience.mk - Email: lab@zeroscience.mk

Goal Reached Thanks to every supporter — we hit 100%!

COMMAX Biometric Access Control System Cookie Reflected XSS (ZSL-2021-5660)