My first CVE by 2018 CVE-2018-5316

Though the vulnerability I tracked her down last year. Mitre has decided to assign it to me this year 2018. The CVE is based on a Cross-site scripting in the plugin “SagePay Server Gateway for WooCommerce” version 1.0.7.

This vulnerability is found in the “page” parameter in the”/wp-content/plugins/sagepay-server-gateway-for-woocommerce/includes/pages/redirect. php” file, which lacks correct filtering methods.

    $res =  '<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">' .
            '<html><head>' .
            '<script type="text/javascript"> function OnLoadEvent() { document.form.submit(); }</script>' .
            '<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />' .
            '<title>3D-Secure Redirect</title></head>' . 
            '<body OnLoad="OnLoadEvent();">' .
            '<form name="form" action="'. urldecode($_GET["page"]) . '" method="POST"  target="_top" >' .
            '<noscript>' .
            '<center><p>Please click button below to Authenticate your card</p><input type="submit" value="Go"/></p></center>' .
            '</noscript>' .
    echo $res;

The following screenshot verifies that the code is executed correctly.



Leave a Reply

Your email address will not be published. Required fields are marked *