Automate Recon and scanning process with Vidoc. All security teams in one place
By kannthu
The "WordPress PHPFreeChat 0.2.8 - Cross-Site Scripting" module is designed to detect a cross-site scripting vulnerability in the WordPress PHPFreeChat 0.2.8 plugin. This vulnerability allows an attacker to execute arbitrary scripts in the browser of an unsuspecting user. The severity of this vulnerability is classified as high, with a CVSS score of 7.2.
This module was authored by daffainfo.
If exploited, this vulnerability can lead to unauthorized script execution in the browser of a user who interacts with the affected WordPress PHPFreeChat 0.2.8 plugin. This can potentially result in the theft of sensitive information, session hijacking, or other malicious activities.
The module sends an HTTP GET request to the following path:
/wp-content/plugins/phpfreechat/lib/csstidy-1.2/css_optimiser.php?url=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E
The module then applies several matching conditions to determine if the vulnerability is present:
- The response body must contain the string</script><script>alert(document.domain)</script>
- The response header must contain the string text/html
- The HTTP status code must be 200
If all of these conditions are met, the module reports the vulnerability.