We did a vulnerability scan on our systems and received a vulnerability:
Basit Submit Module Cross Site Scripting Vulnerability.
We are not even aware of this application on our system. We filed a dispute and it was denied stating this:
If you are attempting to reproduce this issue you should be able to using the Burp Suite and it's repeater tool (available at http://portswigger.net/burp/):
GET /modules/Submit/index.php?op=pre&title=?"><script>alert('XSS')</script> HTTP/1.1 Host: www.example.com User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:58.0) Gecko/20100101 Firefox/58.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cookie: xxxx; FINGER_PRINT=xxxx; currencycode=USD; Connection: close Upgrade-Insecure-Requests: 1 Cache-Control: max-age=0
On accessing the url specified in the evidence, we get a 404 page. for eg. www.example.com/modules/Submit/index.php
How can we resolve this?