CVE-2023-7246

MEDIUMNuclei

System Dashboard < 2.8.10 - XSS via Header Injection

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2023-7246 has a selected CVSS score of 5.4 (medium); EIP currently links 1 Nuclei template.

Description

The System Dashboard WordPress plugin before 2.8.10 does not sanitize and escape some parameters, which could allow administrators in multisite WordPress configurations to perform Cross-Site Scripting attacks

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 5, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

System Dashboard

Default status: unaffected

CVE ListBefore 2.8.10affected

system_dashboard

Browse bowo / system_dashboard

Default status: unknown

CVE ListBefore 2.8.10affected

Nuclei templates

1
ProjectDiscoveryMEDIUMSystem Dashboard < 2.8.10 - Cross-Site ScriptingCVSS 5.4

The System Dashboard WordPress plugin before 2.8.10 does not sanitize and escape some parameters, which could allow administrators in multisite WordPress configurations to perform Cross-Site Scripting attacks through header injection, specifically in the X-Forwarded-For header.

Impact

Authenticated administrators in multisite WordPress configurations can inject malicious JavaScript through X-Forwarded-For header to execute attacks against other WordPress users.

Remediation

Update the System Dashboard plugin to version 2.8.10 or later.

WeaknessesCWE-79
Authorsritikchaddha
Template tagscvecve2023wpwordpressxsswp-pluginauthenticatedsystem-dashboardvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Shodan: html:"wp-content/plugins/system-dashboard/"
FOFA: body="wp-content/plugins/system-dashboard/"
Google: inurl:"/wp-content/plugins/system-dashboard/"
https://wpscan.com/vulnerability/7413d5ec-10a7-4cb8-ac1c-4ef554751518/ https://research.cleantalk.org/cve-2023-7246/ https://nvd.nist.gov/vuln/detail/CVE-2023-7246

Source: ProjectDiscovery

References

2