CVE-2018-19915
published 2018-12-06CVE-2018-19915: DomainMOD through 4.11.01 has XSS via the assets/edit/host.php Web Host Name or Web Host URL field.
PriorityP428medium4.8CVSS 3.0
AVNACLPRHUIRSCCLILAN
EXPLOIT
EPSS
4.01%
89.3th percentile
DomainMOD through 4.11.01 has XSS via the assets/edit/host.php Web Host Name or Web Host URL field.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| domainmod | domainmod | 4.09.03 – 4.11.01 | — |
CVSS provenance
nvdv3.04.8MEDIUMCVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
DomainMOD 4.11.01 - 'assets/edit/host.php?whid=5' Cross-Site Scripting
exploitdb·2019-02-14·CVSS 4.8
CVE-2018-19915 [MEDIUM] DomainMOD 4.11.01 - 'assets/edit/host.php?whid=5' Cross-Site Scripting
DomainMOD 4.11.01 - 'assets/edit/host.php?whid=5' Cross-Site Scripting
---
# Exploit Title: DomainMOD 4.11.01 - Cross-Site Scripting
# Date: 2018-11-22
# Exploit Author: Mohammed Abdul Kareem
# Vendor Homepage: domainmod (https://domainmod.org/)
# Software Link: domainmod (https://github.com/DomainMod/DomainMod)
# Version: v4.09.03 to v4.11.01
# CVE : CVE-2018-19915
# A Stored Cross-site scripting (XSS) was discovered in DomainMod application
# versions from v4.09.03 to v4.11.01
# After logging into the Domainmod application panel, browse to the
/assets/edit/host.php?whid=5 page and inject a javascript XSS payload
in "Web Host Name" & "Web Host's url fields ">
#POC : attached here https://github.com/domainmod/domainmod/issues/87
Nuclei
DomainMOD <=4.11.01 - Cross-Site Scripting
nuclei·CVSS 4.8
CVE-2018-19915 [MEDIUM] DomainMOD <=4.11.01 - Cross-Site Scripting
DomainMOD =4.11.02) to mitigate this vulnerability.
reference:
- https://github.com/domainmod/domainmod/issues/87
- https://www.exploit-db.com/exploits/46376/
- https://nvd.nist.gov/vuln/detail/CVE-2018-19915
- https://github.com/ARPSyndicate/cvemon
- https://github.com/ARPSyndicate/kenzer-templates
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
cvss-score: 4.8
cve-id: CVE-2018-19915
cwe-id: CWE-79
epss-score: 0.00392
epss-percentile: 0.60262
cpe: cpe:2.3:a:domainmod:domainmod:*:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 3
vendor: domainmod
product: domainmod
tags: cve,cve2018,domainmod,xss,authenticated,edb,vuln
http:
- raw:
- |
POST / HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
new_username={{username}}&new_password={
No writeups or analysis indexed.
2018-12-06
Published