Update servicenow-title-injection.yaml

patch-5
Ritik Chaddha 2024-07-15 10:13:33 +05:30 committed by GitHub
parent 054c42c8cf
commit cc3bb11f76
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 4 additions and 5 deletions

View File

@ -23,17 +23,16 @@ info:
tags: cve,cve2024,servicenow,injection
http:
- raw:
- |
GET /login.do?jvar_page_title=<style><foo>abc</foo></style> HTTP/1.1
Host: {{Hostname}}
- method: GET
path:
- "{{BaseURL}}/login.do?jvar_page_title=<style><foo>Injected Title</foo></style>"
matchers-condition: and
matchers:
- type: word
part: body
words:
- '<title><style><foo>abc</foo></style></title>'
- '<title><style><foo>Injected Title</foo></style></title>'
- type: word
part: header