.. / CVE-2018-11473

• XSS
• Nuclei
• Web

Exploit for Monstra CMS 3.0.4 - Cross-Site Scripting (CVE-2018-11473)

Description:

Monstra CMS 3.0.4 contains a cross-site scripting vulnerability via the registration form (i.e., the login parameter to users/registration). An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Nuclei Template

View the template here CVE-2018-11473.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2018/CVE-2018-11473.yaml

References: