CVE-2012-4768

Nuclei

WordPress Plugin Download Monitor - 'dlsearch' Cross-Site Scripting

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2012-4768 has a selected CVSS score of 4.3; EIP currently links 1 catalogued exploit and 1 Nuclei template.

Description

Cross-site scripting (XSS) vulnerability in the Download Monitor plugin before 3.3.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the dlsearch parameter to the default URI.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1
Nuclei templates
1

Proofs of concept

1

Catalogued exploits

ExploitDBWordPress Plugin Download Monitor - 'dlsearch' Cross-Site ScriptingExploitDB exploitby Chris CooperNot analyzed1 file
ExploitDB
PoC details

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress Plugin Download Monitor < 3.3.5.9 - Cross-Site ScriptingCVSS 4.3

A cross-site scripting vulnerability in the Download Monitor plugin before 3.3.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the dlsearch parameter to the default URI.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information.

Remediation

Update to the latest version of Download Monitor (3.3.5.9 or higher) or apply the official patch provided by the plugin developer.

WeaknessesCWE-79
Authorsdaffainfo
Template tagscvecve2012xsswp-pluginpacketstormwordpressmikejolleyvuln
CVSS vector: CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N
CPE: cpe:2.3:a:mikejolley:download_monitor:3.3.5.7:*:*:*:*:wordpress:*:*
Shodan: http.html:"/wp-content/plugins/download-monitor/"
FOFA: body="/wp-content/plugins/download-monitor/"
https://nvd.nist.gov/vuln/detail/CVE-2012-4768 http://packetstormsecurity.org/files/116408/wpdownloadmonitor3357-xss.txt http://www.reactionpenetrationtesting.co.uk/wordpress-download-monitor-xss.html https://exchange.xforce.ibmcloud.com/vulnerabilities/78422 https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

7