Vendor: ObjectPlanet Product: Opinio Version: Up to 7.6.3 (inclusive) Homepage: CVE: CVE-2017-10798 Description ================ Reflected XSS vulnerability in ObjectPlanet Opinio up to version 7.6.3. Vulnerability ================ The /admin/ page is vulnerable to reflected XSS attacks through the userLanguage GET parameter. This page is available to remote, unauthenticated users. Proof of concept ================ https://localhost/admin/;// Mitigations ================ Upgrade to version 7.6.4 or later. References ================ Timeline ================ 2017-03-31 Vulnerability discovered 2017-04-01 Asked vendor how they prefer to receive vulnerability reports 2017-04-03 First response from vendor 2017-04-04 PoC sent to vendor 2017-04-05 Vendor confirms vulnerability. Patch will be included in next release within a few weeks. 2017-04-20 Patch released in version 7.6.4 - "Improved: Fixed some cross-site scripting vulnerabilities." 2017-07-02 CVE Requested and received - "Use CVE-2017-10798." 2017-07-09 Public disclosure Discovered by Kasper Karlsson # Iranian Exploit DataBase = http://IeDb.Ir [2017-07-13]