Epson site-
******************************
******************************
Advisory: pos.epson.com – Cross-Site Script Vulnerability (XSS) Advisory ID:
13062014
Author: Roberto Garcia (@1gbDeInfo)
Affected Software: Successfully tested on pos.epson.com
Vendor URL: https://pos.epson.com Vendor Status: reported but no response
******************************
******************************
**************************
Vulnerability Description
**************************
The website " pos.epson.com " is prone to a XSS vulnerability.
This vulnerability involves the ability to inject arbitrary and unauthorized
javascript code. A malicious script inserted into a page in this manner can
hijack the user’s session, submit unauthorized transactions as the user,
steal confidential information, or simply deface the page.
**************************
PoC-Exploit
**************************
PoC video is available at:
https://mega.co.nz/#F!
**************************
Solution
**************************
Reported but no response
**************************
Disclosure Timeline
**************************
- Report vuln Jun 13, 2014 to: envision_webmaster@ea.epson.
response
**************************
Credits
**************************
------------------------------
--------------
Vulnerability found and advisory written by Roberto Garcia (@1gbDeInfo)
------------------------------
--------------
Best regards.
Roberto Garcia Amoriz
Linkedin: es.linkedin.com/in/rogaramo/
Web: http://www.1gbdeinformacion.
Twitter: @1gbdeinfo
******************************
******************************
Advisory: pos.epson.com – Cross-Site Script Vulnerability (XSS) Advisory ID:
13062014
Author: Roberto Garcia (@1gbDeInfo)
Affected Software: Successfully tested on pos.epson.com
Vendor URL: https://pos.epson.com Vendor Status: reported but no response
******************************
******************************
**************************
Vulnerability Description
**************************
The website " pos.epson.com " is prone to a XSS vulnerability.
This vulnerability involves the ability to inject arbitrary and unauthorized
javascript code. A malicious script inserted into a page in this manner can
hijack the user’s session, submit unauthorized transactions as the user,
steal confidential information, or simply deface the page.
**************************
PoC-Exploit
**************************
PoC video is available at:
https://mega.co.nz/#F!
**************************
Solution
**************************
Reported but no response
**************************
Disclosure Timeline
**************************
- Report vuln Jun 13, 2014 to: envision_webmaster@ea.epson.
response
**************************
Credits
**************************
------------------------------
--------------
Vulnerability found and advisory written by Roberto Garcia (@1gbDeInfo)
------------------------------
--------------
Best regards.
Roberto Garcia Amoriz
Linkedin: es.linkedin.com/in/rogaramo/
Web: http://www.1gbdeinformacion.
Twitter: @1gbdeinfo