Exploit
CVE-2024-9878

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)

Published: Nov 5, 2024 / Updated: 14d ago

010
CVSS 4.8EPSS 0.05%Medium
CVE info copied to clipboard

Summary

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.8.30. This vulnerability is due to insufficient input sanitization and output escaping. It affects multi-site installations and installations where unfiltered_html has been disabled.

Impact

This vulnerability allows authenticated attackers with administrator-level permissions or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses an injected page. This could lead to various attacks such as stealing sensitive information, session hijacking, or manipulating the website's content for users.

Exploitation

One proof-of-concept exploit is available on packetstormsecurity.com. There is no evidence of proof of exploitation at the moment.

Patch

A patch is available. The vulnerability has been addressed in version 1.8.31 of the Photo Gallery by 10Web plugin for WordPress.

Mitigation

1. Update the Photo Gallery by 10Web plugin to version 1.8.31 or later. 2. Implement the principle of least privilege by limiting administrator access only to trusted users. 3. Consider using Web Application Firewalls (WAF) to help detect and block XSS attempts. 4. Regularly audit and review administrator-level user accounts and their activities. 5. For multi-site installations, ensure proper isolation between sites to limit the impact of a potential exploit.

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Timeline

First Article

Feedly found the first article mentioning CVE-2024-9878. See article

Nov 5, 2024 at 10:15 AM / Vulners.com RSS Feed
CVSS Estimate

Feedly estimated the CVSS score as LOW

Nov 5, 2024 at 10:15 AM
CVE Assignment

NVD published the first details for CVE-2024-9878

Nov 5, 2024 at 10:21 AM
CVSS

A CVSS base score of 4.4 has been assigned.

Nov 5, 2024 at 10:26 AM / nvd
EPSS

EPSS Score was set to: 0.05% (Percentile: 16.7%)

Nov 6, 2024 at 10:26 AM
CVSS

A CVSS base score of 4.8 has been assigned.

Nov 8, 2024 at 3:30 PM / nvd
Proof of Concept (PoC) Released

A proof of concept exploit has been released

Nov 8, 2024 at 6:11 PM
Static CVE Timeline Graph

Affected Systems

10web/photo_gallery
+null more

Exploits

https://packetstormsecurity.com/files/179357/WordPress-Photo-Gallery-1.8.26-Cross-Site-Scripting.html
+null more

Patches

plugins.trac.wordpress.org
+null more

Attack Patterns

CAPEC-209: XSS Using MIME Type Mismatch
+null more

News

CVE-2024-9878 Exploit
CVE Id : CVE-2024-9878 Published Date: 2024-11-08T15:25:00+00:00 The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.8.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. inTheWild added a link to an exploit: https://packetstormsecurity.com/files/179357/WordPress-Photo-Gallery-1.8.26-Cross-Site-Scripting.html
CVE-2024-9878
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.8.30 due to insufficient input sanitization and output escaping. Gravedad 3.1 (CVSS 3.1 Base Score)
Photo Gallery by 10Web <= 1.8.30 - Authenticated (Administrator+) Stored Cross-Site Scripting
10web - MEDIUM - CVE-2024-9878 The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.8.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVE-2024-9878 - 10Web Photo Gallery by WordPress Stored Cross-Site Scripting Vulnerability
CVE ID : CVE-2024-9878 Published : Nov. 5, 2024, 10:21 a.m. 44 minutes ago Description : The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.8.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Severity:
CVE-2024-9878
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.8.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been...
See 4 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:High
User Interaction:Required
Scope:Changed
Confidentiality:Low
Integrity:Low
Availability Impact:None

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI