Add initial yaml files for CVE-2021-25296,7,8

cves/2021/CVE-2021-25296.yaml

@@ -1 +1,22 @@
+id: CVE-2021-25296
 
+info:
+  name: Nagios XI 5.7.5 Command Injection
+  author: k0pak4
+  severity: critical
+  description: Nagios XI 5.7.5 is affected by OS command injection. An authenticated user can gain code execution with a single HTTP request due to unsanitized URL paramaters.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-25296
+    - https://github.com/fs0c-sh/nagios-xi-5.7.5-bugs/blob/main/README.md
+    - https://github.com/rapid7/metasploit-framework/pull/17494
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 8.8
+    cve-id: CVE-2021-25296
+    cwe-id: CWE-78
+  tags: cve,cve2021,nagiosxi
+
+requests:
+  - method: GET 
+    - path:
+      - "{{BaseUrl}}/nagiosxi/config/monitoringwizard.php?update=1&nextstep=3&wizard=windowswmi&plugin_output_len=9999;"

cves/2021/CVE-2021-25297.yaml

@@ -1 +1,22 @@
+id: CVE-2021-25297
 
+info:
+  name: Nagios XI 5.7.5 Command Injection
+  author: k0pak4
+  severity: critical
+  description: Nagios XI 5.7.5 is affected by OS command injection. An authenticated user can gain code execution with a single HTTP request due to unsanitized URL paramaters.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-25297
+    - https://github.com/fs0c-sh/nagios-xi-5.7.5-bugs/blob/main/README.md
+    - https://github.com/rapid7/metasploit-framework/pull/17494
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 8.8
+    cve-id: CVE-2021-25297
+    cwe-id: CWE-78
+  tags: cve,cve2021,nagiosxi
+
+requests:
+  - method: GET 
+    - path:
+      - "{{BaseUrl}}/nagiosxi/config/monitoringwizard.php?update=1&ipaddress=127.0.0.1&nextstep=4&wizard=digitalocean"

cves/2021/CVE-2021-25298.yaml

@@ -1 +1,22 @@
+id: CVE-2021-25298
 
+info:
+  name: Nagios XI 5.7.5 Command Injection
+  author: k0pak4
+  severity: critical
+  description: Nagios XI 5.7.5 is affected by OS command injection. An authenticated user can gain code execution with a single HTTP request due to unsanitized URL paramaters.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-25298
+    - https://github.com/fs0c-sh/nagios-xi-5.7.5-bugs/blob/main/README.md
+    - https://github.com/rapid7/metasploit-framework/pull/17494
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 8.8
+    cve-id: CVE-2021-25298
+    cwe-id: CWE-78
+  tags: cve,cve2021,nagiosxi
+
+requests:
+  - method: GET 
+    - path:
+      - "{{BaseUrl}}/nagiosxi/config/monitoringwizard.php?update=1&ipaddress=127.0.0.1&nextstep=4&wizard=digitalocean"