TI-2021-12887 Aliases CVE-2021-33484 GHSA-76j4-qr57-p9fg

An issue was discovered in CommentsService.ashx in OnyakTech Comments Pro 3.8.

LOW 35CWE-798Published 2021-09-07 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · None · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-798.

Summary

An issue was discovered in CommentsService.ashx in OnyakTech Comments Pro 3.8. An attacker can download a copy of the installer, decompile it, and discover a hardcoded IV used to encrypt the username and userid in the comment POST request. Additionally, the attacker can decrypt the encrypted encryption key (sent as a parameter in the comment form request) by setting this encrypted value as the username, which will appear on the comment page in its decrypted form. Using these two values (combined with the encryption functionality discovered in the decompiled installer), the attacker can encrypt another user's ID and username. These values can be used as part of the comment posting request in order to spoof the user.

Why it matters now

EPSS 0.00892 59th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:onyaktech_comments_pro_project:onyaktech_comments_pro:3.8:::::::*	3.8	Vulnerable	Onyaktech Comments Pro Project

cpe:2.3:a:onyaktech_comments_pro_project:onyaktech_comments_pro:3.8:*:*:*:*:*:*:* Versions 3.8 Vulnerable ·Onyaktech Comments Pro Project

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2021-33484
2026-10-03 Alias added: GHSA-76j4-qr57-p9fg

References

Exploit 1

https://burninatorsec.blogspot.com/2021/07/onyaktech-comments-pro-broken.html

Advisory 1

https://twitter.com/onyaktech

TI-2021-12886 An issue was discovered in CommentsService.ashx in OnyakTech Comments Pro 3.8. CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences