CVE-2022-1813

OS Command Injection in GitHub repository yogeshojha/rengine prior to 1.2.0...

Command injection

OS Command Injection in GitHub repository yogeshojha/rengine prior to 1.2.0...

Cross-site Scripting (XSS) - Stored in yogeshojha/rengine

✍️ Description When a XSS payload is used as the name of a gf pattern, it executes. 🕵️‍♂️ Proof of Concept 1. Name a file .json 2. Import the file as a gf pattern at https://127.0.0.1/scanEngine/toolsettings 3. Click on the uploaded gf pattern. 💥 Impact The impact is same as any other Stored XSS...