{"uuid": "0c1d4069-01b9-4c13-ae6e-529c137ee65e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42136", "type": "seen", "source": "https://t.me/hacking_Attack/49916", "content": "Exploit Collector\nREDCap Cross Site Scripting\n\nhttps://4.bp.blogspot.com/-zX4owX_f6gA/WWlvEjBsFTI/AAAAAAAAILA/L-jpFLkKi_AyIykovxrESAdO3HPxIIp7QCLcBGAs/s1600/h132.png \nREDCap versions prior to 11.4.0 suffer from a persistent cross site scripting vulnerability that can be leveraged to escalate privileges.\n\nMD5 | cff2215a44f56d248ac62729a09c91b1\n\nDownload\n# Exploit Title: REDCap < 11.4.0 - Stored Cross-Site Scripting\n# Date: 2021-10-11\n# Exploit Author: Kendrick Lam\n# Vendor Homepage: https://projectredcap.org\n# Software Link: https://projectredcap.org\n# Version: Redcap before 11.4.0\n# Tested on: 11.2.5\n# CVE: CVE-2021-42136\n# Security advisory: https://redcap.med.usc.edu/_shib/assets/ChangeLog_Standard.pdf\n\n### Stored XSS \u2013 Missing Data Code Value (found by Kendrick Lam)\n\nIt was possible to store JavaScript as values for Missing Data Codes.\n\n- Where: Missing Data Code.\n- Payload: \n\n- Details: The payload will escalate a regular user's privileges, if viewed by an account with permission to change privileges (such as an administrator).\n- Privileges: Low privileged / regular user\n- Location example: https://redcap.XXX/redcap/redcap_vv11.2.5/Design/data_dictionary_codebook.php?pid=XX\n\n- Privileges:\n+ Store: Low privileged user is able to store Missing Data Code values.\n+ Execute: Any authenticated user. The payload will trigger once the page loads, this means storing the payload and sending over the link to an administrator would be able to escalate the user's privileges. For example, by browsing to https://redcap.XXX/redcap/redcap_vv11.2.5/Design/data_dictionary_codebook.php?pid=XX\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:45.638479Z"}