daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Update newsletter-open-redirect.yaml

patch-1
Prince Chaddha 2022-02-15 16:33:09 +05:30 committed by GitHub
parent 2d745615c5
commit fea65848db
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
vulnerabilities/wordpress/newsletter-open-redirect.yaml
View File

@ -6,7 +6,7 @@ info:
severity: medium severity: medium
description: The plugin used base64 encoded user input in the appurl parameter without validation, to redirect users using the header() PHP function, leading to an open redirect issue. description: The plugin used base64 encoded user input in the appurl parameter without validation, to redirect users using the header() PHP function, leading to an open redirect issue.
reference: https://wpscan.com/vulnerability/847b3878-da9e-47d6-bc65-3cfd2b3dc1c1 reference: https://wpscan.com/vulnerability/847b3878-da9e-47d6-bc65-3cfd2b3dc1c1
tags: wordpress,redirect,wp-plugin,newsletter tags: wordpress,redirect,wp-plugin,newsletter,wp
requests: requests:
- method: GET - method: GET
@ -16,5 +16,5 @@ requests:
matchers: matchers:
- type: regex - type: regex
regex: regex:
- '(?m)^(?:Location\s*?:\s*?)(?:http?://|//)?(?:[a-zA-Z0-9\-_\.@]*)google\.com.*$' - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)google\.com\/?(\/|[^.].*)?$' # https://regex101.com/r/ZDYhFh/1
part: header part: header