CVEs-PoC/2021/CVE-2021-22872.md

CVE-2021-22872

Description

Revive Adserver before 5.1.0 is vulnerable to a reflected cross-site scripting (XSS) vulnerability via the publicly accessible afr.php delivery script. While this issue was previously addressed in modern browsers as CVE-2020-8115, some older browsers (e.g., IE10) that do not automatically URL encode parameters were still vulnerable.

POC

Reference

• http://packetstormsecurity.com/files/161070/Revive-Adserver-5.0.5-Cross-Site-Scripting-Open-Redirect.html
• https://hackerone.com/reports/986365

Github

• https://github.com/20142995/nuclei-templates
• https://github.com/cyb3r-w0lf/nuclei-template-collection