SOCA Access Control System 180612 Reflected Cross-Site Scripting

Title: SOCA Access Control System 180612 Reflected Cross-Site Scripting
Advisory ID: ZSL-2019-5518
Type: Local/Remote
Impact: Cross-Site Scripting
Risk: (3/5)
Release Date: 13.05.2019
Summary
The company's products include proximity and fingerprint access control system, time and attendance, electric locks, card reader and writer, keyless entry system and other 30 specialized products. All products are attractively designed with advanced technology in accordance with users' safety and convenience which also fitted international standard.
Description
The application suffers from a XSS issue due to a failure to properly sanitize user-supplied input to the 'senddata' POST parameter in the 'logged_page.php' script. Attackers can exploit this weakness to execute arbitrary HTML and script code in a user's browser session.
Vendor
SOCA Technology Co., Ltd - http://www.socatech.com
Affected Version
180612
170000
141007
Tested On
Windows NT 6.1 build 7601 (Windows 7 Service Pack 1) i586
Windows NT 6.2 build 9200 (Windows Server 2012 Standard Edition) i586
Apache/2.2.22 (Win32)
PHP/5.4.13
Vendor Status
N/A
PoC
soca_xss.txt
Credits
Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>
References
[1] https://packetstormsecurity.com/files/152837
[2] https://cxsecurity.com/issue/WLB-2019050151
[3] https://exchange.xforce.ibmcloud.com/vulnerabilities/160976
Changelog
[13.05.2019] - Initial release
[15.05.2019] - Added reference [3]
Contact
Zero Science Lab

Web: http://www.zeroscience.mk
e-mail: lab@zeroscience.mk