{"uuid": "7b1b4414-800f-4c10-9097-f67721038ef3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35475", "type": "seen", "source": "https://t.me/hacking_Attack/14596", "content": "Exploit Collector\nSAS Environment Manager 2.5 Cross Site Scripting\n\nhttps://1.bp.blogspot.com/-9u0QXe9ybeo/WWlvU_DnejI/AAAAAAAAIN0/BUl-HrIsuwE3sKywG67Nuv_wLRABID6oQCLcBGAs/s1600/h45.png \nSAS Environment Manager version 2.5 suffers from a persistent cross site scripting vulnerability.\n\nMD5 | a1bca70f9195c84c7ae4745dbcaceb7e\n\nDownload\n# Exploit Title: SAS Environment Manager 2.5 - 'name' Stored Cross-Site Scripting (XSS)\n# Date: 24/06/2021\n# Exploit Author: Luqman Hakim Zahari @ Saitamang\n# Vendor Homepage: https://support.sas.com/en/software/environment-manager-support.html\n# Version: 2.5\n# Tested on: CentOS 7\n# CVE : CVE-2021-35475\n\n# Description #\n\nSAS\u00ae Environment Manager 2.5 allows XSS through the Name field when creating/editing a server. The XSS will prompt when editing the Configuration Properties.\n\n# Proof of Concept(PoC) # https://github.com/saitamang/CVE-2021-35475/blob/main/README.md\n\n*Steps to Reproduce:*\n\n[1.] Login to your system > On \"Resource\" tab > \"Browse\"\"\n[2.] Choose a \"Platform\"\n[3.] Click \"Inventory\" tab > Under \"Servers\" tab click \"New...\"\n[4.] Under \"General Properties\" tab on \"Name\" field , enter the payload(below) > Filled up other information and click \"Ok\" button\n\npayload : \n\nname=XSS\"> click \"Edit\" button\n[7.] Then the payload will be executed\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:02:34.589969Z"}