CVE-2017-17043

MEDIUMNuclei

WordPress Emag Marketplace Connector 1.0 - Cross-Site Scripting

Title source: github.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2017-17043 has a selected CVSS score of 6.1 (medium); EIP currently links 1 curated repository PoC and 1 Nuclei template.

Description

The Emag Marketplace Connector plugin 1.0.0 for WordPress has reflected XSS because the parameter "post" to /wp-content/plugins/emag-marketplace-connector/templates/order/awb-meta-box.php is not filtered correctly.

Description source: CVE List

Exploitation context

Available material

Curated repository PoCs
1
Nuclei templates
1

Proofs of concept

1

Curated repository PoCs

GitHubCVE-2017-17043Curated repository PoCby yubsy112Not analyzed1 file

Python · 396 B

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress Emag Marketplace Connector 1.0 - Cross-Site ScriptingCVSS 6.1

WordPress Emag Marketplace Connector plugin 1.0 contains a reflected cross-site scripting vulnerability because the parameter "post" to /wp-content/plugins/emag-marketplace-connector/templates/order/awb-meta-box.php is not filtered correctly.

Impact

Successful exploitation of this vulnerability could lead to the theft of sensitive information, session hijacking, or the execution of arbitrary code in the context of the affected user.

Remediation

Update to the latest version of the WordPress Emag Marketplace Connector plugin (1.1) or apply the vendor-provided patch to fix the XSS vulnerability.

WeaknessesCWE-79
Authorsdaffainfo
Template tagscvecve2017xsswp-pluginpacketstormwordpresszitecvuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:zitec:emag_marketplace_connector:1.0.0:*:*:*:*:wordpress:*:*
https://wordpress.org/support/topic/wordpress-emag-marketplace-connector-1-0-cross-site-scripting-vulnerability/ https://packetstormsecurity.com/files/145060/wpemagmc10-xss.txt https://wpvulndb.com/vulnerabilities/8964 https://nvd.nist.gov/vuln/detail/CVE-2017-17043 https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

4