2022-11-18 11:58:34 +00:00
|
|
|
# CVE-2021-36873
|
|
|
|
|
|
|
|
|
|
## Description
|
2022-12-09 08:24:15 +00:00
|
|
|
Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in WordPress iQ Block Country plugin (versions <= 1.2.11). Vulnerable parameter: `&blockcountry_blockmessage`.
|
2022-11-18 11:58:34 +00:00
|
|
|
|
|
|
|
|
## CVSS (Vector and Score)
|
|
|
|
|
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N - 5.5 MEDIUM
|
|
|
|
|
|
|
|
|
|
## Affected Application
|
|
|
|
|
WordPress iQ Block Country plugin
|
|
|
|
|
|
|
|
|
|
## Affected Version
|
|
|
|
|
<= 1.2.11
|
|
|
|
|
|
|
|
|
|
## Total Installation
|
|
|
|
|
30,000+
|
|
|
|
|
|
|
|
|
|
## Steps to Reproduce
|
|
|
|
|
1. Login as administrator
|
2022-12-09 08:24:15 +00:00
|
|
|
2. Go to http://localhost/wp-admin/options-general.php?page=iq-block-country%2Flibs%2Fblockcountry-settings.php
|
|
|
|
|
3. Find `Message to display when people are blocked:` form
|
|
|
|
|
4. Input `</textarea><script>alert(1)</script>`
|
|
|
|
|
5. Scroll down and press `Save Changes` button
|
2022-11-18 11:58:34 +00:00
|
|
|
|
|
|
|
|
## Proof of Concept
|
2022-12-09 08:24:15 +00:00
|
|
|
- Video
|
|
|
|
|
|
|
|
|
|
> https://youtu.be/WtOiHY5R-t0
|
2022-11-18 11:58:34 +00:00
|
|
|
- Image
|
2022-12-09 08:24:15 +00:00
|
|
|
|
