
Proof-of-concept exploit for reflected XSS in SysAid 20.4.74 via KeepAlive.jsp, with timeline and affected versions.
SysAid 20.4.74 allows reflected XSS via the KeepAlive.jsp parameter, without authentication.
Timeline
Discovered: April 28, 2021
Initial Vendor Contact: April 28, 2021
Reported: April 28, 2021
CVE ID issued: April 28, 2021
Secondary Vendor Contact: (Vendor did not reply to initial contact): May 28, 2021
Public Release: October 29, 2021
Affected Versions:
20.4.74 and prior
Credit:
Citadel Cyber Security (https://www.citadel.co.il/)
POC Exploit:
The following URL path and query parameters will trigger an XSS vulnerability.
/KeepAlive.jsp?stamp=&tabID=10&lastClick=1618311643298
