Automate Recon and scanning process with Vidoc. All security teams in one place
By kannthu
The "WordPress AVChat Video Chat 1.4.1 - Cross-Site Scripting" module is designed to detect a vulnerability in the AVChat Video Chat plugin for WordPress. This vulnerability allows for reflected cross-site scripting (XSS) attacks through the index_popup.php file and multiple parameters. The severity of this vulnerability is classified as medium, with a CVSS score of 5.4.
The original author of this module is DhiyaneshDK.
If exploited, this vulnerability could allow an attacker to inject malicious scripts into the affected website, potentially leading to unauthorized access, data theft, or other malicious activities.
The module works by sending a specific HTTP request to the target website and then analyzing the response to determine if the vulnerability is present. The request template used by the module is as follows:
GET /wp-content/plugins/avchat-3/index_popup.php?movie_param=</script><script>alert(document.domain)</script>&FB_appId=FB_appId%22><script>alert(document.domain)</script>& HTTP/1.1
Host: [target website]
The module then applies the following matching conditions to the response:
- The response body must contain the following string:value="FB_appId"><script>alert(document.domain)</script>"
- The response headers must contain the string text/html
- The HTTP status code must be 200
If all of these conditions are met, the module will report the vulnerability.
For more information, you can refer to the Codevigila website.