diff --git a/vulnerabilities/zend/zend-v1-xss.yaml b/vulnerabilities/zend/zend-v1-xss.yaml index 2f9dbda3b7..76de7d8ef7 100644 --- a/vulnerabilities/zend/zend-v1-xss.yaml +++ b/vulnerabilities/zend/zend-v1-xss.yaml @@ -4,21 +4,22 @@ info: name: ZendFramework 1.12.2 - Cross-Site Scripting author: c3l3si4n severity: medium - description: ZendFramework of versions <=1.12.2 contain a cross-site scripting vulnerability via an arbitrarily supplied parameter. + description: | + ZendFramework of versions <=1.12.2 contain a cross-site scripting vulnerability via an arbitrarily supplied parameter. reference: - https://twitter.com/c3l3si4n/status/1600035722148212737 - classification: - cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N - cvss-score: 7.2 - cwe-id: CWE-79 + metadata: + verified: true + google-dork: inurl:"/tests/Zend/Http/" tags: zend,zendframework,xss requests: - method: GET path: - - "{{BaseURL}}/vendor/diablomedia/zendframework1-http/tests/Zend/Http/Client/_files/testRedirections.php?redirection=3¶m=%20a='test'>" - - "{{BaseURL}}/tests/Zend/Http/Client/_files/testRedirections.php?redirection=3¶m=" + - "{{BaseURL}}/vendor/diablomedia/zendframework1-http/tests/Zend/Http/Client/_files/testRedirections.php?redirection=3¶m=" + - "{{BaseURL}}/tests/Zend/Http/Client/_files/testRedirections.php?redirection=3¶m=" + stop-at-first-match: true matchers-condition: and matchers: - type: word @@ -29,11 +30,11 @@ requests: - '