漏洞描述
SIS Informatik REWE GO SP17 before 7.7 contains a cross-site scripting vulnerability via rewe/prod/web/index.php (affected parameters are config, version, win, db, pwd, and user) and /rewe/prod/web/rewe_go_check.php (version and all other parameters).
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
sec-consult.comhttps://sec-consult.com/vulnerability-lab/advisory/reflected-xss-sis-infromatik-rewe-go-cve-2021-31537/↗seclists.orghttp://seclists.org/fulldisclosure/2021/May/20↗sisinformatik.comhttps://sisinformatik.com/rewe-go/↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2021-31537↗github.comhttps://github.com/ARPSyndicate/cvemon↗