CVE-2021-24235

MEDIUMNuclei

Goto - Tour & Travel < 2.0 - Unauthenticated Reflected XSS

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2021-24235 has a selected CVSS score of 6.1 (medium); EIP currently links 2 curated repository PoCs and 1 Nuclei template.

Description

The Goto WordPress theme before 2.0 does not sanitise the keywords and start_date GET parameter on its Tour List page, leading to an unauthenticated reflected Cross-Site Scripting issue.

Description source: CVE List

Exploitation context

Available material

Curated repository PoCs
2
Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

Goto

CVE List2.0 to < 2.0affected

Proofs of concept

2

Curated repository PoCs

GitHubCVE-2021-24235Curated repository PoCby 0xd3vil127Not analyzed1 file

Python · 642 B

GitHub
PoC details
GitHubCVE-2021-24235Curated repository PoCby yubsy112Not analyzed1 file

Python · 642 B

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress Goto Tour & Travel Theme <2.0 - Cross-Site ScriptingCVSS 6.1

WordPress Goto Tour & Travel theme before 2.0 contains an unauthenticated reflected cross-site scripting vulnerability. It does not sanitize the keywords and start_date GET parameters on its Tour List page.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into the website, leading to potential data theft, session hijacking, or defacement.

Remediation

Update to the latest version of the WordPress Goto Tour & Travel Theme (>=2.0) to mitigate the XSS vulnerability.

WeaknessesCWE-79
Authorsdaffainfo
Template tagscve2021cvexsswp-themewpscanwordpressboostifythemesvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:boostifythemes:goto:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/eece90aa-582b-4c49-8b7c-14027f9df139 https://m0ze.ru/vulnerability/[2021-02-10]-[WordPress]-[CWE-79]-Goto-WordPress-Theme-v1.9.txt https://nvd.nist.gov/vuln/detail/CVE-2021-24235 https://m0ze.ru/vulnerability/%5B2021-02-10%5D-%5BWordPress%5D-%5BCWE-79%5D-Goto-WordPress-Theme-v1.9.txt https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

4