.. / CVE-2017-14622

• XSS
• Nuclei
• Web

Exploit for WordPress 2kb Amazon Affiliates Store <2.1.1 - Cross-Site Scripting (CVE-2017-14622)

Description:

WordPress 2kb Amazon Affiliates Store plugin before 2.1.1 contains multiple cross-site scripting vulnerabilities. The plugin allows an attacker to inject arbitrary web script or HTML via the (1) page parameter or (2) kbAction parameter in the kbAmz page to wp-admin/admin.php, thus making possible theft of cookie-based authentication credentials and launch of other attacks.

Nuclei Template

View the template here CVE-2017-14622.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2017/CVE-2017-14622.yaml

References: