CVE-2017-9288

MEDIUMNuclei

WordPress Raygun4WP <=1.8.0 - Cross-Site Scripting

Title source: github.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2017-9288 has a selected CVSS score of 6.1 (medium); EIP currently links 2 curated repository PoCs and 1 Nuclei template.

Description

The Raygun4WP plugin 1.8.0 for WordPress is vulnerable to a reflected XSS in sendtesterror.php (backurl parameter).

Description source: CVE List

Exploitation context

Available material

Curated repository PoCs
2
Nuclei templates
1

Proofs of concept

2

Curated repository PoCs

GitHubCVE-2017-9288Curated repository PoCby yubsy112Not analyzed1 file

Python · 306 B

GitHub
PoC details
GitHubCVE-2017-9288Curated repository PoCby 0xd3vil127Not analyzed1 file

Python · 306 B

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress Raygun4WP <=1.8.0 - Cross-Site ScriptingCVSS 6.1

WordPress Raygun4WP 1.8.0 contains a reflected cross-site scripting vulnerability via sendtesterror.php.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the affected website, potentially leading to session hijacking, defacement, or theft of sensitive information.

Remediation

Update to the latest version of the WordPress Raygun4WP plugin (1.8.0 or higher) to mitigate this vulnerability.

WeaknessesCWE-79
Authorsdaffainfo
Template tagscve2017cvewordpressxsswp-pluginraygunvuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:raygun:raygun4wp:1.8.0:*:*:*:*:wordpress:*:*
https://github.com/MindscapeHQ/raygun4wordpress/pull/17 https://github.com/MindscapeHQ/raygun4wordpress/issues/16 http://jgj212.blogspot.kr/2017/05/a-reflected-xss-vulnerability-in.html https://nvd.nist.gov/vuln/detail/CVE-2017-9288 https://wpvulndb.com/vulnerabilities/8836

Source: ProjectDiscovery

References

5