CVE-2021-43696
Description
twmap v2.91_v4.33 is affected by a Cross Site Scripting (XSS) vulnerability. In file list.php, the exit function will terminate the script and print the message to the user. The message will contain $_REQUEST then there is a XSS vulnerability.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- twmap/twmapdescription
Patches
Vulnerability mechanics
Root cause
"Missing output sanitization of the `$_REQUEST['sEcho']` parameter before it is echoed back in the JSON response, allowing arbitrary JavaScript injection."
Attack vector
An attacker can send a crafted HTTP request to `list.php` with a malicious payload in the `sEcho` parameter of the query string or POST body. The script reads this value from `$_REQUEST['sEcho']` and embeds it into the JSON response that is printed to the user via `exit(json_encode($response))` [ref_id=1]. Because the value is not sanitized, an attacker can inject JavaScript that executes in the victim's browser when the response is rendered.
Affected code
The vulnerable file is `twmap_gen/list.php` in the twmap project (version v2.91_v4.33). At line 33, the script assigns `$_REQUEST['sEcho']` directly into the `$response` array and then passes the entire response through `json_encode()` and `exit()` [ref_id=1]. The `$_REQUEST` value is not sanitized or escaped before being output.
What the fix does
The advisory does not include a published patch or fix commit [ref_id=1]. To remediate the vulnerability, the `$_REQUEST['sEcho']` value should be sanitized or HTML-encoded before being placed into the JSON response, or the application should validate that the input contains only expected characters (e.g., a numeric echo identifier) rather than arbitrary user-controlled strings.
Preconditions
- networkThe attacker must be able to send HTTP requests to the twmap application's list.php endpoint.
- authNo authentication or special privileges are required; the vulnerable endpoint is publicly accessible.
- inputThe attacker supplies a malicious payload in the 'sEcho' request parameter.
Generated on May 30, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
1- github.com/happyman/twmap/issues/57mitrex_refsource_MISC
News mentions
0No linked articles in our index yet.