CVE-2022-3024 Simple Bitcoin Faucets <= 1.7.0 - Unauthorised AJAX Call to Stored XSS

2022-09-2600:00:00

CWE-863

CWE-352

WPScan

www.cve.org

bitcoin faucets

wordpress plugin

unauthorised ajax call

stored xss

csrf

sanitisation

0.001 Low

EPSS

Percentile

21.4%

JSON

The Simple Bitcoin Faucets WordPress plugin through 1.7.0 does not have any authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscribers to call it and add/delete/edit Bonds. Furthermore, due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Bitcoin Satoshi Tools :  Faucets, Visitor Rewarder, Satoshi Games, Referral Program",
    "versions": [
      {
        "version": "1.7.0",
        "status": "affected",
        "lessThanOrEqual": "1.7.0",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/7f43cb8e-0c1b-4528-8c5c-b81ab42778dc

0.001 Low

EPSS

Percentile

21.4%

JSON

Related for CVELIST:CVE-2022-3024