WordPress Woody Ad Snippets <2.2.5 - Cross-Site Scripting/Remote Code Execution

highseverity

8.8CVSS score

20%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

WordPress Woody Ad Snippets prior to 2.2.5 is susceptible to cross-site scripting and remote code execution via admin/includes/class.import.snippet.php, which allows unauthenticated options import as demonstrated by storing a cross-site scripting payload for remote code execution.

Impact

Successful exploitation of this vulnerability could lead to unauthorized access, data theft, and remote code execution.

Fix

Update to the latest version of the Woody Ad Snippets plugin (2.2.5) or apply the vendor-provided patch to mitigate the vulnerability.

How to confirm it

Send: GET {{BaseURL}}/wp-content/plugins/insert-php/readme.txt
Positive when: not contains "2.2.5" AND contains "Changelog" AND contains "Woody ad snippets" AND status 200

Run it with nuclei: nuclei -id CVE-2019-15858 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2019-15858

info:
  name: WordPress Woody Ad Snippets <2.2.5 - Cross-Site Scripting/Remote Code Execution
  author: dwisiswant0,fmunozs,patralos
  severity: high
  description: |
    WordPress Woody Ad Snippets prior to 2.2.5 is susceptible to cross-site scripting and remote code execution via admin/includes/class.import.snippet.php, which allows unauthenticated options import as demonstrated by storing a cross-site scripting payload for remote code execution.
  impact: |
    Successful exploitation of this vulnerability could lead to unauthorized access, data theft, and remote code execution.
  remediation: |
    Update to the latest version of the Woody Ad Snippets plugin (2.2.5) or apply the vendor-provided patch to mitigate the vulnerability.
  reference:
    - https://github.com/GeneralEG/CVE-2019-15858
    - https://blog.nintechnet.com/multiple-vulnerabilities-in-wordpress-woody-ad-snippets-plugin-lead-to-remote-code-execution/
    - https://wpvulndb.com/vulnerabilities/9490
    - https://nvd.nist.gov/vuln/detail/CVE-2019-15858
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2019-15858
    cwe-id: CWE-306
    epss-score: 0.19967
    epss-percentile: 0.97456
    cpe: cpe:2.3:a:webcraftic:woody_ad_snippets:*:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 1
    vendor: webcraftic
    product: woody_ad_snippets
    framework: wordpress
  tags: cve,cve2019,wordpress,wp-plugin,xss,wp,webcraftic,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/insert-php/readme.txt"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        negative: true
        words:
          - "2.2.5"

      - type: word
        part: body
        words:
          - "Changelog"

      - type: word
        part: body
        words:
          - "Woody ad snippets"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from