WordPress eCommerce Music Store <=1.0.14 - Open Redirect

ID: music-store-open-redirect

Severity: medium

Author: dhiyaneshDk

Tags: musicstore,wp,wpscan,seclists,wordpress,redirect,wp-plugin

Description

WordPress eCommerce Music Store plugin through 1.0.14 contains an open redirect vulnerability via the referer header. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.

YAML Source

id: music-store-open-redirect

info:
  name: WordPress eCommerce Music Store <=1.0.14 - Open Redirect
  author: dhiyaneshDk
  severity: medium
  description: WordPress eCommerce Music Store plugin through 1.0.14 contains an open redirect vulnerability via the referer header. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  reference:
    - https://wpscan.com/vulnerability/d73f6575-eb86-480c-bde1-f8765870cdd1
    - https://seclists.org/fulldisclosure/2015/Jul/113
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cwe-id: CWE-601
  metadata:
    max-request: 1
  tags: musicstore,wp,wpscan,seclists,wordpress,redirect,wp-plugin

http:
  - raw:
      - |
        GET /wp-content/plugins/music-store/ms-core/ms-submit.php HTTP/1.1
        Host: {{Hostname}}
        Referer: https://interact.sh

    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/L403F0/1
# digest: 4a0a00473045022100d97dbfd66bac8625194ce5c3a6e1ab3283471c1640ba566969a530b3dbb2f78c022007454b1700911ac0b5c37cf3887360293225a615f45a91de6d998a8407782e39:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/vulnerabilities/wordpress/music-store-open-redirect.yaml"

View on Github