Exploitation Summary
EIP tracks 1 public exploit for CVE-2019-25315. PoCs published by strider.
AI-analyzed exploit summary The exploit demonstrates a persistent XSS vulnerability in WP Server Log Viewer 1.0 due to unfiltered input in the 'logpath' parameter. The PoC shows how an attacker can inject malicious JavaScript via an image tag with an onerror event handler.
Description
WordPress Server Log Viewer 1.0 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through unfiltered log file paths. Attackers can add log files with embedded XSS payloads that will execute when viewed in the WordPress admin interface.
Exploits (1)
The exploit demonstrates a persistent XSS vulnerability in WP Server Log Viewer 1.0 due to unfiltered input in the 'logpath' parameter. The PoC shows how an attacker can inject malicious JavaScript via an image tag with an onerror event handler.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N