diff --git a/cves/2019/CVE-2019-9978.yaml b/cves/2019/CVE-2019-9978.yaml index 1047ac3eab..a0aa394399 100644 --- a/cves/2019/CVE-2019-9978.yaml +++ b/cves/2019/CVE-2019-9978.yaml @@ -6,23 +6,25 @@ info: severity: medium description: The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro. reference: https://github.com/mpgn/CVE-2019-9978 - tags: cve,cve2019,wordpress,wp-plugin,ssrf classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.10 cve-id: CVE-2019-9978 cwe-id: CWE-79 + tags: cve,cve2019,wordpress,wp-plugin,ssrf requests: - method: GET path: - "{{BaseURL}}/wp-admin/admin-post.php?swp_debug=load_options&swp_url={{interactsh-url}}" + matchers-condition: and matchers: - type: status status: - 200 + - type: word + part: interactsh_protocol words: - - "Burp Collabolator Server" - part: body + - "http"