download-manager Plugin up to 2.9.51 on WordPress wp-admin/admin-ajax.php wpdm_generate_password ID cross site scripting

Summaryinfo

A vulnerability was found in download-manager Plugin up to 2.9.51 on WordPress. It has been rated as problematic. This vulnerability affects the function wpdm_generate_password of the file wp-admin/admin-ajax.php. This manipulation of the argument ID as part of Parameter causes cross site scripting. This vulnerability is registered as CVE-2017-18032. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in download-manager Plugin up to 2.9.51 on WordPress (WordPress Plugin). It has been declared as problematic. Affected by this vulnerability is the function wpdm_generate_password of the file wp-admin/admin-ajax.php. The manipulation of the argument id as part of a Parameter leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. As an impact it is known to affect integrity. The summary by CVE is:

The download-manager plugin before 2.9.52 for WordPress has XSS via the id parameter in a wpdm_generate_password action to wp-admin/admin-ajax.php.

The bug was discovered 09/29/2017. The weakness was published 01/16/2018 (Website). It is possible to read the advisory at security.dxw.com. This vulnerability is known as CVE-2017-18032 since 01/16/2018. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1059.007 according to MITRE ATT&CK.

The vulnerability was handled as a non-public zero-day exploit for at least 109 days. During that time the estimated underground price was around $0-$5k. By approaching the search of inurl:wp-admin/admin-ajax.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 2.9.52 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• WordPress Plugin

Name

• download-manager Plugin

Version

• 2.9.0
• 2.9.1
• 2.9.2
• 2.9.3
• 2.9.4
• 2.9.5
• 2.9.6
• 2.9.7
• 2.9.8
• 2.9.9
• 2.9.10
• 2.9.11
• 2.9.12
• 2.9.13
• 2.9.14
• 2.9.15
• 2.9.16
• 2.9.17
• 2.9.18
• 2.9.19
• 2.9.20
• 2.9.21
• 2.9.22
• 2.9.23
• 2.9.24
• 2.9.25
• 2.9.26
• 2.9.27
• 2.9.28
• 2.9.29
• 2.9.30
• 2.9.31
• 2.9.32
• 2.9.33
• 2.9.34
• 2.9.35
• 2.9.36
• 2.9.37
• 2.9.38
• 2.9.39
• 2.9.40
• 2.9.41
• 2.9.42
• 2.9.43
• 2.9.44
• 2.9.45
• 2.9.46
• 2.9.47
• 2.9.48
• 2.9.49
• 2.9.50
• 2.9.51

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion