ETAP Safety Manager 1.0.0.32 Cross Site Scripting

`  
ETAP Safety Manager 1.0.0.32 Remote Unauthenticated Reflected XSS  
  
  
Vendor: ETAP Lighting International NV  
Product web page: https://www.etaplighting.com  
Affected version: 1.0.0.32  
  
Summary: The ETAP Safety Manager (ESM) is a central managing and control  
system that helps you to monitor, adjust and maintain your emergency lighting  
system. Therefore each luminaire connected to your ESM network is given a  
unique code. The ESM can easily identify the luminaires individually and  
automatically report whether all luminaires work properly. You can either  
choose between a wired or wireless network, or a combination of both. With  
ESM you will not only manage your self contained or your centrally supplied  
‘ETAP Battery System’ (EBS) emergency luminaires’, but also DALI emergency  
units and K9 LED modules, which you can build into your luminaires. Since  
your ESM system is connected to the Internet, you will always have access  
to it through the World Wide Web. ESMweb™ is an ‘embedded web server’  
application for monitoring an emergency lighting system, which runs in the  
‘ESM web controller’. The ESMweb™ application can be accessed from any PC  
in the corporate network or connected to the Internet - by a standard web  
browser.  
  
Desc: Input passed to the GET parameter 'action' is not properly sanitised  
before being returned to the user. This can be exploited to execute arbitrary  
HTML/JS code in a user's browser session in context of an affected site.  
  
Tested on: Apache/2.4.41 (Ubuntu)  
  
  
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic  
@zeroscience  
  
  
Advisory ID: ZSL-2022-5711  
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5711.php  
  
  
22.08.2022  
  
--  
  
  
PoC:  
  
GET /json/authenticate.php?action=[XSS]&username=waddup&password=nm HTTP/1.1  
  
{"success":false,"errorMessage":"Invalid command: $","errorCode":0,"errorInfo":"\/var\/www\/etap-root\/scripts\/class.dispatch.php(39)","rows":[]}  
`