CVE-2024-13055

HIGHNuclei

Dyn Business Panel <= 1.0.0 - Reflected XSS

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-13055 has a selected CVSS score of 7.1 (high); EIP currently links 1 Nuclei template.

Description

The Dyn Business Panel WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 27, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Dyn Business Panel

Default status: affected

CVE ListThrough 1.0.0affected

Nuclei templates

1
ProjectDiscoveryHIGHDyn Business Panel Plugin <= 1.0.0 - Cross-Site ScriptingCVSS 7.1

Dyn Business Panel WordPress plugin <= 1.0.0 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter in output, letting attackers execute scripts in the context of high privilege users, exploit requires victim to click a malicious link.

Impact

Attackers can execute arbitrary scripts in the context of high privilege users, potentially leading to account compromise or data theft.

Remediation

Update to the latest version of the plugin where the issue is fixed or implement proper sanitization and escaping measures.

WeaknessesCWE-79
AuthorsSourabh-Sahu
Template tagscvecve2024dyn-business-panelwordpresswpwp-pluginxssauthenticated
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
CPE: cpe:2.3:a:phycticio:dyn_business_panel:1.0.0:*:*:*:*:*:*:*
https://wpscan.com/vulnerability/91178272-ed7e-412c-a187-e360a1313004/ https://nvd.nist.gov/vuln/detail/CVE-2024-13055

Source: ProjectDiscovery

References

2