Rockwell Automation Allen-Bradley 1752-EN2T/C and 1769-L33ER/A LOGIX5333ER suffer from a cross site scripting vulnerability.
e23dc1b77f6e27a4977ea92c71bd5b53################################
# Exploit Title: Rockwell Automation Allen-Bradley 1752-EN2T/C, 1769-L33ER/A LOGIX5333ER Cross Site Scripting
# Google Dork: N/A
# Date: 5/12/2018
# Exploit Author: n4pst3r
# Vendor Homepage: https://www.rockwellautomation.com/
# Software Link: unkn0wn
# Version: 1752-EN2T/C, 1769-L33ER/A LOGIX5333ER
# Tested on: Embedded Linux, owned by https://www.rockwellautomation.com/
# CVE : n/a
################################
* On the Rockwell Automation website Allen-Bradley 1752-EN2T / C and 1769-L33ER / A LOGIX5333ER
* A user can find devices online, searching "Shodan.io" "zoomeye.org" and "censys.io".
* Most of these devices do not have an authentication system, so access to the platform is easy.
* Attackers can inject malicious XSS code into various parameters of the route: Diagnostics => Advanced Diagnostics => Micellaneous => system Data
################################
PoC:
http://127.0.0.1/rokform/SysDataDetail?name=<script>alert("XSS")</script>Assert
################################