diff --git a/cves/2021/CVE-2021-27330.yaml b/cves/2021/CVE-2021-27330.yaml index 2113ab1c6e..563a0f5ebf 100644 --- a/cves/2021/CVE-2021-27330.yaml +++ b/cves/2021/CVE-2021-27330.yaml @@ -2,12 +2,12 @@ id: CVE-2021-27330 info: name: Triconsole 3.75 XSS - author: pikpikcu + author: pikpikcu,daffainfo severity: medium - description: Triconsole Datepicker Calendar <3.77 is affected by cross-site scripting (XSS) in calendar_form.php. Attackers can read authentication cookies that are still active, which can be used to perform further - attacks such as reading browser history, directory listings, and file contents. - reference: - - https://www.exploit-db.com/exploits/49597 + description: Triconsole Datepicker Calendar <3.77 is affected by cross-site scripting (XSS) in calendar_form.php. Attackers can read authentication cookies that are still active, which can be used to perform further attacks such as reading browser history, directory listings, and file contents. + reference: https://www.exploit-db.com/exploits/49597 + metadata: + google-dork: intitle:TriConsole.com - PHP Calendar Date Picker classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 @@ -18,19 +18,21 @@ info: requests: - method: GET path: - - '{{BaseURL}}/calendar_form.php/">' + - '{{BaseURL}}/calendar/calendar_form.php/">' + matchers-condition: and matchers: - - type: word - words: - - "" part: body + words: + - '' + - 'TriConsole.com - PHP Calendar Date Picker' + condition: and - type: word + part: header words: - "text/html" - part: header - type: status status: