# Welcome
Welcome to the section dedicated to vulnerabilities and Common Vulnerabilities and Exposures ([CVE](https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) that I have obtained during my research as a penetration tester. Here you will find detailed information on the various vulnerabilities I discovered, including their impact, exploitation steps, and advice on how to apply remediations.
If you have any questions or suggestions, please do not hesitate to contact me via one of the contact information available on [my website](https://nstsec.com).
Thank you for your interest in cybersecurity and happy browsing!
# CVE-2022-44023
PwnDoc <= 0.5.3 - Username Enumeration via different responses
## CVE Detail
PwnDoc through 0.5.3 might allow remote attackers to identify disabled user account names by leveraging response messages for authentication attempts.
## Exploitation Steps
It is possible to enumerate "disabled account" usernames in PwnDoc (tested on 0.5.3 - 2022-07-19) observing the web server responses to login requests.\
For example, let's suppose these users were registered on PwnDoc and then disabled:
Trying to log in with one of these disabled users in fact the application responds with the message "Account disabled".
Client request and server response:
Trying to log in with a user who does not exist, the application responds with "Invalid credentials":
This server behavior can be exploited to enumerate disabled users on the platform, who may be re-enabled by an admin and used again in the future.
By performing a brute force dictionary attack, a defined list of users can be provided via login POST request to detect all the "Account disabled" server's responses and exclude the "Invalid credentials" ones.
The standard recommendation to mitigate this vulnerability is to return identical responses for “valid user/wrong password” and “invalid user” login requests.
# CVE-2022-44022
PwnDoc <= 0.5.3 - Username Enumeration via response timings
## CVE Detail
PwnDoc through 0.5.3 might allow remote attackers to identify valid user account names by leveraging response timings for authentication attempts.
## Exploitation Steps
It is possible to enumerate users registered in PwnDoc (tested on 0.5.3 - 2022-07-19 and previous versions) observing the web server response timing.\
For example, let's suppose these users were registered on PwnDoc:
By performing a brute force dictionary attack, a defined list of users can be provided via login POST request to detect the server's response time.
All the valid users can be discovered by a potential attacker checking if the response time to the login request is long. For not-existing users we can see a shorter response time.
The attack success depends higly on the stability of the server and the Internet connection between hosts. In any case, in order to apply a remediation, it is advisable to add a timing delay to balance the response timing for each login request.
# CVE-2020-13654
XWiki Platform before 12.8 mishandles escaping in the property displayer.
## CVE Detail
In XWiki Platform before 12.8, some fileds like "Company" in the user profile editing section are vulnerables to Stored Cross Site Scripting (XSS).
## Exploitation Steps
As I first reported at , I report below the steps describing the identified vulnerability.
Some fileds like "Company" in the user profile editing section, are vulnerables to Cross Site Scripting XSS.
So, inserting for example "\" in the Company field someone has access to this page can inject malicious code.
An attacker can use XSS to send a malicious script to an unsuspecting user. The end user’s browser has no way to know that the script should not be trusted, and will execute the script. Because it thinks the script came from a trusted source, the malicious script can access any cookies, session tokens, or other sensitive information retained by the browser and used with that site.
Following are the steps to reproduce the vulnerability:
1. Login as admin
2. Create a test user
3. Open the user profile page (\)
4. Click edit button near Personal Information
5. Edit Company field and insert for example \
6. Save & View and see the XSS in action
