CVE-2020-20982

CRITICALNuclei

shadoweb wdja v1.5.1 - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2020-20982 has a selected CVSS score of 9.6 (critical); EIP currently links 1 Nuclei template.

Description

Cross Site Scripting (XSS) vulnerability in shadoweb wdja v1.5.1, allows attackers to execute arbitrary code and gain escalated privileges, via the backurl parameter to /php/passport/index.php.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryCRITICALshadoweb wdja v1.5.1 - Cross-Site ScriptingCVSS 9.6

shadoweb wdja v1.5.1 is susceptible to cross-site scripting because it allows attackers to execute arbitrary code and gain escalated privileges via the backurl parameter to /php/passport/index.php.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of the victim's browser, leading to potential data theft, session hijacking, or defacement of the affected website.

Remediation

Upgrade to the latest version to mitigate this vulnerability.

WeaknessesCWE-79
Authorspikpikcu, ritikchaddha
Template tagscve2020cvexsswdjashadowebvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CPE: cpe:2.3:a:wdja:wdja_cms:1.5.1:*:*:*:*:*:*:*
https://github.com/shadoweb/wdja/issues/1 https://nvd.nist.gov/vuln/detail/CVE-2020-20982 https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

2