.. / CVE-2023-0099

Exploit for WordPress Plugin Simple URLs < 115 - Cross-Site Scripting (CVE-2023-0099)

Description:

The plugin does not sanitise and escape some parameters before outputting them back in some pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Affected Products:

WordPress Plugin Simple URLs < 115

Proof of Concept

PoC exploit

http://packetstormsecurity.com/files/176983/WordPress-Simple-URLs-Cross-Site-Scripting.html
https://wpscan.com/vulnerability/fd50f2d6-e420-4220-b485-73f33227e8f8/

Nuclei Template

View the template here CVE-2023-0099.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2023/CVE-2023-0099.yaml

References:

https://nvd.nist.gov/vuln/detail/CVE-2023-0099
https://wpscan.com/vulnerability/fd50f2d6-e420-4220-b485-73f33227e8f8
https://wordpress.org/plugins/simple-urls/
http://packetstormsecurity.com/files/176983/WordPress-Simple-URLs-Cross-Site-Scripting.html

.. / CVE-2023-0099 if(localStorage["style"]=="true"){ document.getElementById('pagestyle').setAttribute('href','/assets/styleDark.css'); document.querySelector('input[type="checkbox"]').checked = true }