""ET WEB_SPECIFIC_APPS WordPress Plugin Job Manager Stored Cross-Site Scripting""

SID: 2025839

Revision: 2

Class Type: attempted-user

Metadata: affected_product Wordpress_Plugins, attack_target Web_Server, created_at 2018_07_16, deployment Datacenter, performance_impact Low, signature_severity Major, updated_at 2018_07_16

Reference:

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: any

Destination Network: $HTTP_SERVERS

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

  • Value: "/?step=|00|"

  • Value: "submit-job-form"

  • Value: "enctype=|22|multipart/form-data|22|"

Within:

PCRE: "/enctype=\x22multipart/form-data\x22[^&]+(?:s(?:cript|tyle\x3D)|on(?:mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))/Ui"

Special Options:

  • http_uri

  • http_uri

  • fast_pattern

  • http_uri

source