CVE-2021-30134 PoC — WordPress Plugin php-mod/curl 跨站脚本漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-30134.yaml

Associated Vulnerability

Title:WordPress Plugin php-mod/curl 跨站脚本漏洞 (CVE-2021-30134)
Description:WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress Plugin php-mod/curl 2.3.2之前版本存在安全漏洞，该漏洞源于允许通过post_file_path_upload.php关键参数和post_multidimensional.php的POST数据进行XSS。

Description

Php-mod/curl library before 2.3.2 contains a cross-site scripting vulnerability via the post_file_path_upload.php key parameter and the POST data to post_multidimensional.php. An attacker can inject arbitrary script, which can allow theft of cookie-based authentication credentials and launch of other attacks.

File Snapshot


 id: CVE-2021-30134

info:
  name: Php-mod/curl Library <2.3.2 - Cross-Site Scripting
  author: theam

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!