{"vulnerability": "CVE-2021-42063", "sightings": [{"uuid": "58d16653-1602-454a-ad2e-2e88528d24d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42063", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-42063.yaml", "content": "", "creation_timestamp": "2023-04-27T09:58:59.000000Z"}, {"uuid": "d27725db-325d-4030-b5ae-f32faa0155b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42063", "type": "published-proof-of-concept", "source": "https://t.me/HackingInsights/12514", "content": "My recon methodology for hunting CVE-2021\u201342063 led to discovering an RXSS vulnerability in the\u2026: https://medium.com/@karthithehacker/my-recon-methodology-for-hunting-cve-2021-42063-led-to-discovering-an-rxss-vulnerability-in-the-27a7aa435fd3?source=rss------bug_bounty-5", "creation_timestamp": "2024-09-09T03:38:14.000000Z"}, {"uuid": "eacfd1fd-f3c8-4075-9674-3cdf43e26af6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42063", "type": "published-proof-of-concept", "source": "https://t.me/HackingInsights/12209", "content": "My recon methodology for hunting CVE-2021\u201342063 led to discovering an RXSS vulnerability in the\u2026: https://medium.com/@karthithehacker/my-recon-methodology-for-hunting-cve-2021-42063-led-to-discovering-an-rxss-vulnerability-in-the-80bd4ca0f623?source=rss------bug_bounty-5", "creation_timestamp": "2024-09-08T06:15:31.000000Z"}, {"uuid": "9507277c-86ff-4f73-ae11-26b46a33ed8c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42063", "type": "seen", "source": "https://t.me/true_secator/4505", "content": "SAP \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0438\u044e\u043d\u044c\u0441\u043a\u0438\u0439 \u043f\u0430\u0442\u0447 \u0434\u043b\u044f \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0438\u0439 8 \u043d\u043e\u0432\u044b\u0445 \u0431\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u0435\u0439 \u0438 5 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u043a \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0438\u043c. \n\nSAP\u00a0\u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0430 \u043e\u0448\u0438\u0431\u043a\u0443 \u0445\u0440\u0430\u043d\u0438\u043c\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0430\u0439\u0442\u043e\u0432\u043e\u0433\u043e \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u044f (XSS) \u0432 UI5 Variant Management. \n\n\u041e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u043c\u0430\u044f \u043a\u0430\u043a CVE-2023-33991 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS 8,2), \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u043a \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044e \u0438 \u043d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u0438, \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u0438.\n\n\u0412\u0442\u043e\u0440\u0430\u044f \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u2014 \u044d\u0442\u043e \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 Plant Connectivity and Production Connector \u0434\u043b\u044f \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0433\u043e \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0441\u0442\u0432\u0430, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a CVE-2023-2827 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS 7,9).\n\n\u041e\u0448\u0438\u0431\u043a\u0443 \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u043c\u0443 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044e \u0431\u0435\u0437 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0432\u0435\u0431-\u0442\u043e\u043a\u0435\u043d\u0430 JSON (JWT).\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 Onapsis, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u044d\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043e\u0431\u0430 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 \u0434\u043e\u043b\u0436\u043d\u044b \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b, \u0430 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u043f\u043e\u0434\u043f\u0438\u0441\u0438 JWT \u0434\u043e\u043b\u0436\u043d\u0430 \u0431\u044b\u0442\u044c \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043d\u0430 \u0432 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u0445 Cloud Connector.\n\n\u041d\u0430 \u044d\u0442\u043e\u0439 \u043d\u0435\u0434\u0435\u043b\u0435 SAP \u0442\u0430\u043a\u0436\u0435 \u043e\u0431\u043d\u043e\u0432\u0438\u043b\u0430 \u0434\u0432\u0435 \u0437\u0430\u043c\u0435\u0442\u043a\u0438 \u0434\u043b\u044f \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u044b\u0445 \u043e\u0448\u0438\u0431\u043e\u043a \u0432 \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0435 \u0437\u043d\u0430\u043d\u0438\u0439 (CVE-2021-42063) \u0438 SAPUI5 (CVE-2023-30743).\n\n\u0418\u0437 \u0432\u043e\u0441\u044c\u043c\u0438 \u043d\u043e\u0432\u044b\u0445 \u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043f\u0440\u0438\u043c\u0435\u0447\u0430\u043d\u0438\u0439 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0441\u0440\u0435\u0434\u043d\u0435\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438 \u0448\u0435\u0441\u0442\u044c \u043a\u0430\u0441\u0430\u044e\u0442\u0441\u044f \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u043e\u0432 XSS \u0432 NetWeaver, CRM ABAP (Grantor Management), CRM (\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0439 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 WebClient) \u0438 BusinessObjects.\n\n\u0414\u0432\u0435 \u0434\u0440\u0443\u0433\u0438\u0435 \u0437\u0430\u043c\u0435\u0442\u043a\u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0442 \u043e\u0448\u0438\u0431\u043a\u0443 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0432 S/4HANA \u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f SQL \u0432 Master Data Synchronization.\n\n\u041f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0435 \u043f\u0440\u0438\u043c\u0435\u0447\u0430\u043d\u0438\u0435 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0438\u0437\u043a\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0442\u043a\u0430\u0437\u0430 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 (DoS) \u0432 NetWeaver (Change and Transport System).", "creation_timestamp": "2023-06-15T16:30:05.000000Z"}, {"uuid": "139874ec-741e-49b2-ace2-17e796f05666", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42063", "type": "published-proof-of-concept", "source": "https://t.me/thebugbountyhunter/9101", "content": "My recon methodology for hunting CVE-2021\u201342063 led to discovering an RXSS vulnerability in the Tata Play program Part -2 .\n\nhttps://medium.com/@karthithehacker/my-recon-methodology-for-hunting-cve-2021-42063-led-to-discovering-an-rxss-vulnerability-in-the-27a7aa435fd3", "creation_timestamp": "2024-09-08T14:25:06.000000Z"}, {"uuid": "2d693bde-55d4-4abc-b2f6-e70d284c6e3e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42063", "type": "seen", "source": "https://t.me/hacking_Attack/142155", "content": "My recon methodology for hunting CVE-2021\u201342063 led to discovering an RXSS vulnerability in the\u2026\nhttps://medium.com/@karthithehacker/my-recon-methodology-for-hunting-cve-2021-42063-led-to-discovering-an-rxss-vulnerability-in-the-27a7aa435fd3?source=rss------bug_bounty-5", "creation_timestamp": "2026-09-01T20:00:30.871829Z"}, {"uuid": "b109c0ed-97ae-4b8e-9a02-eb5f248688b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42063", "type": "seen", "source": "https://t.me/hacking_Attack/142157", "content": "If you\u2019re new to this writeup, I suggest you read part 1 where I shared some valuable info about my recon and other processes.Continue reading on Medium \u00bb (https://medium.com/@karthithehacker/my-recon-methodology-for-hunting-cve-2021-42063-led-to-discovering-an-rxss-vulnerability-in-the-27a7aa435fd3?source=rss------bug_bounty-5)", "creation_timestamp": "2026-09-01T20:00:30.926681Z"}, {"uuid": "837bcf25-2c22-48d5-b9ed-718db048d09f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42063", "type": "seen", "source": "https://t.me/hacking_Attack/142248", "content": "My recon methodology for hunting CVE-2021\u201342063 led to discovering an RXSS vulnerability in the\u2026\n\nMy recon methodology for hunting CVE-2021\u201342063 led to discovering an RXSS vulnerability in the Tata Play program Part -1 . During one of my bug bounty hunting sessions, I came across an interesting vulnerability: CVE-2021\u201342063. Let me walk you through how I found this bug and explain the steps I followed. To begin, I always rely on a recon tool that I developed called Ghost Recon. This tool helps me with subdomain enumeration and brute-forcing. Of course, you can do the same process without Ghost Recon. If you\u2019re interested in trying it, you can check it out on GitHub: Ghost Recon. For this recon phase, I started by running two tools: subfinder and subsleuth. These help in finding and enumerating subdomains efficiently. The commands I used are:subfinder -d tataplay.com -all -o subfinder.txt subsleuth -d tataplay.com -w wordlist.txt -o output.txt Next, I combined the results, removed duplicates, and performed the process multiple times to ensure I didn\u2019t miss any subdomains. The results were sorted and refined into a file of third-level domains. Here\u2019s how I cleaned up the results:cat * | sort -u | tee -a dup.txt cat dup.txt | rev | cut -d \".\" -f 1,2,3 | sort -u | rev >> 3rdlevel.txt subfinder -dL 3rdlevel.txt -o final.txt subsleuth -l 3rdlevel.txt -w wordlist.txt -o final1.txt cat * | sort -u | tee -a done.txt With the recon process done, it was time to move on to port scanning. I used my custom script and tools like naabu for this. Once the ports were scanned, I fed the results into httpx to identify live hosts:httpx -l ports-withsubs.txt -o live.txt Now, here\u2019s where the magic happens. I installed the CVE-2021\u201342063 tool from pip, which automates the process of detecting the vulnerability:pip install CVE-2021-42063 pip install yaml #if needed CVE-2021-42063 --chatid  CVE-2021-42063 -i urls.txt -o out.txt This tool does all the work for you. It scans the provided URLs for the vulnerability, and if it finds any, you get a notification on Telegram instantly. In this case, it flagged the vulnerable URL on partner.tataplay.com. This vulnerability, CVE-2021\u201342063, was a reflected XSS (R-XSS) in the SAP Knowledge Warehouse component. Exploiting this allowed an attacker to execute scripts in a user\u2019s browser, potentially stealing sensitive information or hijacking the user\u2019s session.Tool POC: In part 2, I will write about the CVE, the core details of the bug, along with POC images. POC by: @karthithehacker Mail: contact@karthithehacker.com Website: https://www.karthithehacker.com/ If you\u2019re interested in our VAPT service, contact us at ceo@cappriciosec.com or contact@cappriciosec.com.Connect with me: Twitter: https://twitter.com/karthithehacker Instagram: https://www.instagram.com/karthithehacker/ LinkedIn: https://www.linkedin.com/in/karthikeyan--v/ Website: https://www.karthithehacker.com/ Github : https://github.com/karthi-the-hacker/ npmjs: https://www.npmjs.com/~karthithehacker Youtube: https://www.youtube.com/@karthi_the_hackerThank you Karthikeyan.V My recon methodology for hunting CVE-2021\u201342063 led to discovering an RXSS vulnerability in the\u2026 was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.\nRead more...", "creation_timestamp": "2026-09-01T20:00:31.040227Z"}, {"uuid": "a5718296-a562-428e-9104-72c9d9a6db49", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42063", "type": "seen", "source": "https://t.me/hacking_Attack/142105", "content": "My recon methodology for hunting CVE-2021\u201342063 led to discovering an RXSS vulnerability in the\u2026\nhttps://medium.com/@karthithehacker/my-recon-methodology-for-hunting-cve-2021-42063-led-to-discovering-an-rxss-vulnerability-in-the-80bd4ca0f623?source=rss------bug_bounty-5", "creation_timestamp": "2026-09-01T20:00:31.188879Z"}, {"uuid": "23e8623e-b667-4510-85b8-75c5014f54e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42063", "type": "seen", "source": "https://t.me/hacking_Attack/142107", "content": "During one of my bug bounty hunting sessions, I came across an interesting vulnerability: CVE-2021\u201342063. Let me walk you through how I\u2026Continue reading on Medium \u00bb (https://medium.com/@karthithehacker/my-recon-methodology-for-hunting-cve-2021-42063-led-to-discovering-an-rxss-vulnerability-in-the-80bd4ca0f623?source=rss------bug_bounty-5)", "creation_timestamp": "2026-09-01T20:00:31.231744Z"}, {"uuid": "9cf97219-07e4-43f7-8a27-a60e4569e44c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42063", "type": "seen", "source": "https://t.me/hacking_Attack/142107", "content": "During one of my bug bounty hunting sessions, I came across an interesting vulnerability: CVE-2021\u201342063. Let me walk you through how I\u2026Continue reading on Medium \u00bb (https://medium.com/@karthithehacker/my-recon-methodology-for-hunting-cve-2021-42063-led-to-discovering-an-rxss-vulnerability-in-the-80bd4ca0f623?source=rss------bug_bounty-5)", "creation_timestamp": "2026-09-02T01:00:49.231526Z"}, {"uuid": "cdbb29bb-ec28-4287-9544-2f93dc24f489", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42063", "type": "seen", "source": "https://t.me/hacking_Attack/142248", "content": "My recon methodology for hunting CVE-2021\u201342063 led to discovering an RXSS vulnerability in the\u2026\n\nMy recon methodology for hunting CVE-2021\u201342063 led to discovering an RXSS vulnerability in the Tata Play program Part -1 . During one of my bug bounty hunting sessions, I came across an interesting vulnerability: CVE-2021\u201342063. Let me walk you through how I found this bug and explain the steps I followed. To begin, I always rely on a recon tool that I developed called Ghost Recon. This tool helps me with subdomain enumeration and brute-forcing. Of course, you can do the same process without Ghost Recon. If you\u2019re interested in trying it, you can check it out on GitHub: Ghost Recon. For this recon phase, I started by running two tools: subfinder and subsleuth. These help in finding and enumerating subdomains efficiently. The commands I used are:subfinder -d tataplay.com -all -o subfinder.txt subsleuth -d tataplay.com -w wordlist.txt -o output.txt Next, I combined the results, removed duplicates, and performed the process multiple times to ensure I didn\u2019t miss any subdomains. The results were sorted and refined into a file of third-level domains. Here\u2019s how I cleaned up the results:cat * | sort -u | tee -a dup.txt cat dup.txt | rev | cut -d \".\" -f 1,2,3 | sort -u | rev >> 3rdlevel.txt subfinder -dL 3rdlevel.txt -o final.txt subsleuth -l 3rdlevel.txt -w wordlist.txt -o final1.txt cat * | sort -u | tee -a done.txt With the recon process done, it was time to move on to port scanning. I used my custom script and tools like naabu for this. Once the ports were scanned, I fed the results into httpx to identify live hosts:httpx -l ports-withsubs.txt -o live.txt Now, here\u2019s where the magic happens. I installed the CVE-2021\u201342063 tool from pip, which automates the process of detecting the vulnerability:pip install CVE-2021-42063 pip install yaml #if needed CVE-2021-42063 --chatid  CVE-2021-42063 -i urls.txt -o out.txt This tool does all the work for you. It scans the provided URLs for the vulnerability, and if it finds any, you get a notification on Telegram instantly. In this case, it flagged the vulnerable URL on partner.tataplay.com. This vulnerability, CVE-2021\u201342063, was a reflected XSS (R-XSS) in the SAP Knowledge Warehouse component. Exploiting this allowed an attacker to execute scripts in a user\u2019s browser, potentially stealing sensitive information or hijacking the user\u2019s session.Tool POC: In part 2, I will write about the CVE, the core details of the bug, along with POC images. POC by: @karthithehacker Mail: contact@karthithehacker.com Website: https://www.karthithehacker.com/ If you\u2019re interested in our VAPT service, contact us at ceo@cappriciosec.com or contact@cappriciosec.com.Connect with me: Twitter: https://twitter.com/karthithehacker Instagram: https://www.instagram.com/karthithehacker/ LinkedIn: https://www.linkedin.com/in/karthikeyan--v/ Website: https://www.karthithehacker.com/ Github : https://github.com/karthi-the-hacker/ npmjs: https://www.npmjs.com/~karthithehacker Youtube: https://www.youtube.com/@karthi_the_hackerThank you Karthikeyan.V My recon methodology for hunting CVE-2021\u201342063 led to discovering an RXSS vulnerability in the\u2026 was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.\nRead more...", "creation_timestamp": "2026-09-02T01:00:48.977476Z"}, {"uuid": "5740f1d8-0d58-4b63-9a0a-e8d582106d7e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42063", "type": "seen", "source": "https://t.me/hacking_Attack/142105", "content": "My recon methodology for hunting CVE-2021\u201342063 led to discovering an RXSS vulnerability in the\u2026\nhttps://medium.com/@karthithehacker/my-recon-methodology-for-hunting-cve-2021-42063-led-to-discovering-an-rxss-vulnerability-in-the-80bd4ca0f623?source=rss------bug_bounty-5", "creation_timestamp": "2026-09-02T01:00:49.158862Z"}, {"uuid": "3a5d8ff9-5c44-495b-b66f-4faaa8be395c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42063", "type": "seen", "source": "https://t.me/hacking_Attack/142155", "content": "My recon methodology for hunting CVE-2021\u201342063 led to discovering an RXSS vulnerability in the\u2026\nhttps://medium.com/@karthithehacker/my-recon-methodology-for-hunting-cve-2021-42063-led-to-discovering-an-rxss-vulnerability-in-the-27a7aa435fd3?source=rss------bug_bounty-5", "creation_timestamp": "2026-09-02T01:00:48.826063Z"}, {"uuid": "da461cbf-d290-4838-a9ec-69dc0c30d76b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42063", "type": "seen", "source": "https://t.me/hacking_Attack/142157", "content": "If you\u2019re new to this writeup, I suggest you read part 1 where I shared some valuable info about my recon and other processes.Continue reading on Medium \u00bb (https://medium.com/@karthithehacker/my-recon-methodology-for-hunting-cve-2021-42063-led-to-discovering-an-rxss-vulnerability-in-the-27a7aa435fd3?source=rss------bug_bounty-5)", "creation_timestamp": "2026-09-02T01:00:48.877578Z"}, {"uuid": "f5f19f42-5f55-46d8-8d52-77eb95acf22a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42063", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/142107", "content": "During one of my bug bounty hunting sessions, I came across an interesting vulnerability: CVE-2021\u201342063. Let me walk you through how I\u2026Continue reading on Medium \u00bb (https://medium.com/@karthithehacker/my-recon-methodology-for-hunting-cve-2021-42063-led-to-discovering-an-rxss-vulnerability-in-the-80bd4ca0f623?source=rss------bug_bounty-5)", "creation_timestamp": "2026-09-03T17:00:05.123414Z"}, {"uuid": "a184938a-eaf5-4461-a6b4-fc9c585ead20", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42063", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/142105", "content": "My recon methodology for hunting CVE-2021\u201342063 led to discovering an RXSS vulnerability in the\u2026\nhttps://medium.com/@karthithehacker/my-recon-methodology-for-hunting-cve-2021-42063-led-to-discovering-an-rxss-vulnerability-in-the-80bd4ca0f623?source=rss------bug_bounty-5", "creation_timestamp": "2026-09-03T17:00:05.176384Z"}, {"uuid": "11deabf9-5063-4b0b-bc81-75474a0b7762", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42063", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/142248", "content": "My recon methodology for hunting CVE-2021\u201342063 led to discovering an RXSS vulnerability in the\u2026\n\nMy recon methodology for hunting CVE-2021\u201342063 led to discovering an RXSS vulnerability in the Tata Play program Part -1 . During one of my bug bounty hunting sessions, I came across an interesting vulnerability: CVE-2021\u201342063. Let me walk you through how I found this bug and explain the steps I followed. To begin, I always rely on a recon tool that I developed called Ghost Recon. This tool helps me with subdomain enumeration and brute-forcing. Of course, you can do the same process without Ghost Recon. If you\u2019re interested in trying it, you can check it out on GitHub: Ghost Recon. For this recon phase, I started by running two tools: subfinder and subsleuth. These help in finding and enumerating subdomains efficiently. The commands I used are:subfinder -d tataplay.com -all -o subfinder.txt subsleuth -d tataplay.com -w wordlist.txt -o output.txt Next, I combined the results, removed duplicates, and performed the process multiple times to ensure I didn\u2019t miss any subdomains. The results were sorted and refined into a file of third-level domains. Here\u2019s how I cleaned up the results:cat * | sort -u | tee -a dup.txt cat dup.txt | rev | cut -d \".\" -f 1,2,3 | sort -u | rev >> 3rdlevel.txt subfinder -dL 3rdlevel.txt -o final.txt subsleuth -l 3rdlevel.txt -w wordlist.txt -o final1.txt cat * | sort -u | tee -a done.txt With the recon process done, it was time to move on to port scanning. I used my custom script and tools like naabu for this. Once the ports were scanned, I fed the results into httpx to identify live hosts:httpx -l ports-withsubs.txt -o live.txt Now, here\u2019s where the magic happens. I installed the CVE-2021\u201342063 tool from pip, which automates the process of detecting the vulnerability:pip install CVE-2021-42063 pip install yaml #if needed CVE-2021-42063 --chatid  CVE-2021-42063 -i urls.txt -o out.txt This tool does all the work for you. It scans the provided URLs for the vulnerability, and if it finds any, you get a notification on Telegram instantly. In this case, it flagged the vulnerable URL on partner.tataplay.com. This vulnerability, CVE-2021\u201342063, was a reflected XSS (R-XSS) in the SAP Knowledge Warehouse component. Exploiting this allowed an attacker to execute scripts in a user\u2019s browser, potentially stealing sensitive information or hijacking the user\u2019s session.Tool POC: In part 2, I will write about the CVE, the core details of the bug, along with POC images. POC by: @karthithehacker Mail: contact@karthithehacker.com Website: https://www.karthithehacker.com/ If you\u2019re interested in our VAPT service, contact us at ceo@cappriciosec.com or contact@cappriciosec.com.Connect with me: Twitter: https://twitter.com/karthithehacker Instagram: https://www.instagram.com/karthithehacker/ LinkedIn: https://www.linkedin.com/in/karthikeyan--v/ Website: https://www.karthithehacker.com/ Github : https://github.com/karthi-the-hacker/ npmjs: https://www.npmjs.com/~karthithehacker Youtube: https://www.youtube.com/@karthi_the_hackerThank you Karthikeyan.V My recon methodology for hunting CVE-2021\u201342063 led to discovering an RXSS vulnerability in the\u2026 was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.\nRead more...", "creation_timestamp": "2026-09-03T17:00:05.334544Z"}, {"uuid": "0e5bbf33-d87a-4558-bb4f-8c1b0a8e05a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42063", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/142157", "content": "If you\u2019re new to this writeup, I suggest you read part 1 where I shared some valuable info about my recon and other processes.Continue reading on Medium \u00bb (https://medium.com/@karthithehacker/my-recon-methodology-for-hunting-cve-2021-42063-led-to-discovering-an-rxss-vulnerability-in-the-27a7aa435fd3?source=rss------bug_bounty-5)", "creation_timestamp": "2026-09-03T17:00:05.438131Z"}, {"uuid": "c4524059-8dab-4382-a32c-be2998b396a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42063", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/142155", "content": "My recon methodology for hunting CVE-2021\u201342063 led to discovering an RXSS vulnerability in the\u2026\nhttps://medium.com/@karthithehacker/my-recon-methodology-for-hunting-cve-2021-42063-led-to-discovering-an-rxss-vulnerability-in-the-27a7aa435fd3?source=rss------bug_bounty-5", "creation_timestamp": "2026-09-03T17:00:05.488480Z"}, {"uuid": "f619c4a0-cbfb-42f5-bf00-d1bfdde938b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42063", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/142248", "content": "My recon methodology for hunting CVE-2021\u201342063 led to discovering an RXSS vulnerability in the\u2026\n\nMy recon methodology for hunting CVE-2021\u201342063 led to discovering an RXSS vulnerability in the Tata Play program Part -1 . During one of my bug bounty hunting sessions, I came across an interesting vulnerability: CVE-2021\u201342063. Let me walk you through how I found this bug and explain the steps I followed. To begin, I always rely on a recon tool that I developed called Ghost Recon. This tool helps me with subdomain enumeration and brute-forcing. Of course, you can do the same process without Ghost Recon. If you\u2019re interested in trying it, you can check it out on GitHub: Ghost Recon. For this recon phase, I started by running two tools: subfinder and subsleuth. These help in finding and enumerating subdomains efficiently. The commands I used are:subfinder -d tataplay.com -all -o subfinder.txt subsleuth -d tataplay.com -w wordlist.txt -o output.txt Next, I combined the results, removed duplicates, and performed the process multiple times to ensure I didn\u2019t miss any subdomains. The results were sorted and refined into a file of third-level domains. Here\u2019s how I cleaned up the results:cat * | sort -u | tee -a dup.txt cat dup.txt | rev | cut -d \".\" -f 1,2,3 | sort -u | rev >> 3rdlevel.txt subfinder -dL 3rdlevel.txt -o final.txt subsleuth -l 3rdlevel.txt -w wordlist.txt -o final1.txt cat * | sort -u | tee -a done.txt With the recon process done, it was time to move on to port scanning. I used my custom script and tools like naabu for this. Once the ports were scanned, I fed the results into httpx to identify live hosts:httpx -l ports-withsubs.txt -o live.txt Now, here\u2019s where the magic happens. I installed the CVE-2021\u201342063 tool from pip, which automates the process of detecting the vulnerability:pip install CVE-2021-42063 pip install yaml #if needed CVE-2021-42063 --chatid  CVE-2021-42063 -i urls.txt -o out.txt This tool does all the work for you. It scans the provided URLs for the vulnerability, and if it finds any, you get a notification on Telegram instantly. In this case, it flagged the vulnerable URL on partner.tataplay.com. This vulnerability, CVE-2021\u201342063, was a reflected XSS (R-XSS) in the SAP Knowledge Warehouse component. Exploiting this allowed an attacker to execute scripts in a user\u2019s browser, potentially stealing sensitive information or hijacking the user\u2019s session.Tool POC: In part 2, I will write about the CVE, the core details of the bug, along with POC images. POC by: @karthithehacker Mail: contact@karthithehacker.com Website: https://www.karthithehacker.com/ If you\u2019re interested in our VAPT service, contact us at ceo@cappriciosec.com or contact@cappriciosec.com.Connect with me: Twitter: https://twitter.com/karthithehacker Instagram: https://www.instagram.com/karthithehacker/ LinkedIn: https://www.linkedin.com/in/karthikeyan--v/ Website: https://www.karthithehacker.com/ Github : https://github.com/karthi-the-hacker/ npmjs: https://www.npmjs.com/~karthithehacker Youtube: https://www.youtube.com/@karthi_the_hackerThank you Karthikeyan.V My recon methodology for hunting CVE-2021\u201342063 led to discovering an RXSS vulnerability in the\u2026 was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.\nRead more...", "creation_timestamp": "2026-09-04T00:00:41.896424Z"}, {"uuid": "a09d0dd1-bfeb-4a0b-994b-6a35e8b4420f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42063", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/142107", "content": "During one of my bug bounty hunting sessions, I came across an interesting vulnerability: CVE-2021\u201342063. Let me walk you through how I\u2026Continue reading on Medium \u00bb (https://medium.com/@karthithehacker/my-recon-methodology-for-hunting-cve-2021-42063-led-to-discovering-an-rxss-vulnerability-in-the-80bd4ca0f623?source=rss------bug_bounty-5)", "creation_timestamp": "2026-09-04T00:00:41.689979Z"}, {"uuid": "7a98c6e6-3e01-4ee6-bb98-2d11605a60ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42063", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/142105", "content": "My recon methodology for hunting CVE-2021\u201342063 led to discovering an RXSS vulnerability in the\u2026\nhttps://medium.com/@karthithehacker/my-recon-methodology-for-hunting-cve-2021-42063-led-to-discovering-an-rxss-vulnerability-in-the-80bd4ca0f623?source=rss------bug_bounty-5", "creation_timestamp": "2026-09-04T00:00:41.745751Z"}, {"uuid": "ddcec112-8a41-4023-8b7d-1d3f1145f4cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42063", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/142157", "content": "If you\u2019re new to this writeup, I suggest you read part 1 where I shared some valuable info about my recon and other processes.Continue reading on Medium \u00bb (https://medium.com/@karthithehacker/my-recon-methodology-for-hunting-cve-2021-42063-led-to-discovering-an-rxss-vulnerability-in-the-27a7aa435fd3?source=rss------bug_bounty-5)", "creation_timestamp": "2026-09-04T00:00:42.003280Z"}, {"uuid": "f5f93bc6-05d2-4451-8079-22114a65c5fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42063", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/142155", "content": "My recon methodology for hunting CVE-2021\u201342063 led to discovering an RXSS vulnerability in the\u2026\nhttps://medium.com/@karthithehacker/my-recon-methodology-for-hunting-cve-2021-42063-led-to-discovering-an-rxss-vulnerability-in-the-27a7aa435fd3?source=rss------bug_bounty-5", "creation_timestamp": "2026-09-04T00:00:42.111122Z"}]}