daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Enhancement: cves/2021/CVE-2021-24875.yaml by md

patch-1
MostInterestingBotInTheWorld 2023-03-13 14:05:02 -04:00
parent 014beba2dc
commit 7d6842bca2
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
cves/2021/CVE-2021-24875.yaml
View File

@ -1,12 +1,12 @@
id: CVE-2021-24875 id: CVE-2021-24875
info: info:
name: eCommerce Product Catalog for WordPress < 3.0.39 - Reflected Cross-Site Scripting name: WordPress eCommerce Product Catalog <3.0.39 - Cross-Site Scripting
author: r3Y3r53 author: r3Y3r53
severity: medium severity: medium
description: | description: |
The plugin does not escape the ic-settings-search parameter before outputting it back in the page in an attribute, leading to a Reflected Cross-Site Scripting issue. WordPress eCommerce Product Catalog plugin before 3.0.39 contains a cross-site scripting vulnerability. The plugin does not escape the ic-settings-search parameter before outputting it back in the page in an attribute. This can allow an attacker to steal cookie-based authentication credentials and launch other attacks.
remediation: Fixed in version 3.0.39 remediation: Fixed in version 3.0.39.
reference: reference:
- https://wpscan.com/vulnerability/652efc4a-f931-4668-ae74-a58b288a5715 - https://wpscan.com/vulnerability/652efc4a-f931-4668-ae74-a58b288a5715
- https://nvd.nist.gov/vuln/detail/CVE-2021-24875 - https://nvd.nist.gov/vuln/detail/CVE-2021-24875
@ -40,3 +40,5 @@ requests:
- 'contains(body_2, "alert(document.domain)")' - 'contains(body_2, "alert(document.domain)")'
- 'contains(body_2, "eCommerce Product Catalog")' - 'contains(body_2, "eCommerce Product Catalog")'
condition: and condition: and
# Enhanced by md on 2023/03/13