minor -update

patch-1
pussycat0x 2023-06-12 15:45:51 +05:30 committed by GitHub
parent 4b03a558db
commit 44695ff802
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 8 additions and 21 deletions

View File

@ -1,15 +1,10 @@
id: CVE-2013-2621
info:
name: Telaen before v1.3.1 - Open Redirect
description: |
.Open Redirection Vulnerability in the redir.php script in Telaen before 1.3.1 allows remote attackers to redirect victims to arbitrary websites via a crafted URL.
name: Telaen => v1.3.1 - Open Redirect
author: ctflearner
severity: medium
tags:
- Telaen
- Open redirect
- web
- cve2013
description: |
Open Redirection Vulnerability in the redir.php script in Telaen before 1.3.1 allows remote attackers to redirect victims to arbitrary websites via a crafted URL.
reference:
- https://www.exploit-db.com/exploits/38546
- https://exchange.xforce.ibmcloud.com/vulnerabilities/84683
@ -20,14 +15,13 @@ info:
cve-id: CVE-2013-2621
cwe-id: CWE-601
cpe: cpe:2.3:a:telaen_project:telaen:*:*:*:*:*:*:*:*
metadata:
max-request: 1
tags: cve,cve2012,telaen,redirect
http:
- method: GET
path:
- "{{BaseURL}}/telaen/redir.php? http://www.evil.com"
- "{{BaseURL}}/telaen/redir.php?https://interact.sh"
- "{{BaseURL}}/redir.php?https://interact.sh"
stop-at-first-match: true
matchers-condition: and
@ -35,11 +29,4 @@ http:
- type: regex
part: header
regex:
- '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)evil\.com\/?(\/|[^.].*)?$'
- type: status
status:
- 301
- 302
- 307
- 308
condition: or
- '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$'