CVE-2021-31537: SIS SIS-REWE Go before 7.7 SP17 allows XSS: rewe/prod/web/index.php (affected parameters are config, version, win, db, pwd, and user) and…

PriorityP341medium6.1CVSS 3.1

AVNACLPRNUIRSCCLILAN

EXPLOIT

EPSS

7.78%

93.9th percentile

SIS SIS-REWE Go before 7.7 SP17 allows XSS: rewe/prod/web/index.php (affected parameters are config, version, win, db, pwd, and user) and /rewe/prod/web/rewe_go_check.php (version and all other parameters).

Affected

2 ranges

Vendor	Product	Version range	Fixed in
sisinformatik	sis-rewe_go	< 7.7	7.7
sisinformatik	sis-rewe_go	—	—

Detection & IOCsextracted from sources · hover to see the quote

path/rewe/prod/web/index.php↗

path/rewe/prod/web/rewe_go_check.php↗

→XSS probe via GET/POST parameters: config, version, win, db, pwd, user on /rewe/prod/web/index.php — monitor for script injection payloads in these parameters ↗
→XSS probe via all parameters on /rewe/prod/web/rewe_go_check.php — monitor for reflected script content in HTTP responses from this endpoint ↗
→Active exploitation/PoC uses a confirm() JavaScript payload as XSS proof-of-concept; detect confirm() calls reflected in HTML responses from the affected paths
→Response Content-Type of text/html is expected when XSS is triggered; correlate with the affected PHP endpoints for detection

·Vulnerability affects SIS-REWE Go versions before 7.7 SP17 only; patched instances running SP17 or later are not affected ↗

CVSS provenance

nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.