CVE-2021-24237

MEDIUMNuclei

Realteo < 1.2.4 - Unauthenticated Reflected Cross-Site Scripting (XSS)

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2021-24237 has a selected CVSS score of 6.1 (medium); EIP currently links 2 curated repository PoCs and 1 Nuclei template.

Description

The Realteo WordPress plugin before 1.2.4, used by the Findeo Theme, did not properly sanitise the keyword_search, search_radius. _bedrooms and _bathrooms GET parameters before outputting them in its properties page, leading to an unauthenticated reflected Cross-Site Scripting issue.

Description source: CVE List

Exploitation context

Available material

Curated repository PoCs
2
Nuclei templates
1

Affected products and versions

2
ProductSourceVersion range

Findeo

Browse PureThemes / Findeo
CVE List1.3.1 to < 1.3.1affected

Realteo

Browse PureThemes / Realteo
CVE List1.2.4 to < 1.2.4affected

Proofs of concept

2

Curated repository PoCs

GitHubCVE-2021-24237Curated repository PoCby yubsy112Not analyzed1 file

Python · 654 B

GitHub
PoC details
GitHubCVE-2021-24237Curated repository PoCby 0xd3vil127Not analyzed1 file

Python · 654 B

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress Realteo <=1.2.3 - Cross-Site ScriptingCVSS 6.1

WordPress Realteo plugin 1.2.3 and prior contains an unauthenticated reflected cross-site scripting vulnerability due to improper sanitization of keyword_search, search_radius. _bedrooms and _bathrooms GET parameters before outputting them in its properties page.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement.

Remediation

Update to the latest version of the WordPress Realteo plugin (>=1.2.4) which includes a fix for the Cross-Site Scripting vulnerability.

WeaknessesCWE-79
Authors0x_Akoko
Template tagscve2021cverealteoxsswordpresspluginwpscanintrusivepurethemesvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:purethemes:findeo:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/087b27c4-289e-410f-af74-828a608a4e1e https://m0ze.ru/vulnerability/[2021-03-20]-[WordPress]-[CWE-79]-Realteo-WordPress-Plugin-v1.2.3.txt https://nvd.nist.gov/vuln/detail/CVE-2021-24237 https://m0ze.ru/vulnerability/[2021-03-20]-[WordPress]-[CWE-79]-Findeo-WordPress-Theme-v1.3.0.txt https://www.docs.purethemes.net/findeo/knowledge-base/changelog-findeo/

Source: ProjectDiscovery

References

7