CVE-2024-12400
📋 TL;DR
The tourmaster WordPress plugin before version 5.3.5 fails to properly escape URLs before outputting them in HTML attributes, allowing attackers to inject malicious scripts. This reflected cross-site scripting vulnerability affects WordPress sites using vulnerable versions of the tourmaster plugin. Attackers can exploit this by tricking users into clicking specially crafted links.
💻 Affected Systems
- tourmaster WordPress plugin
📦 What is this software?
Tour Master by Goodlayers
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal session cookies, perform actions as authenticated users, or redirect users to malicious sites, potentially leading to full site compromise.
Likely Case
Attackers steal user session cookies or credentials, leading to unauthorized access to user accounts.
If Mitigated
With proper input validation and output escaping, the vulnerability is prevented, and no impact occurs.
🎯 Exploit Status
Exploitation requires user interaction (clicking a malicious link) and knowledge of the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.3.5
Vendor Advisory: https://wpscan.com/vulnerability/3542315c-93c3-41dd-a99e-02a38cfd58fb/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find tourmaster plugin. 4. Click 'Update Now' if available, or manually update to version 5.3.5 or later.
🔧 Temporary Workarounds
Disable tourmaster plugin
allTemporarily disable the vulnerable plugin until patched.
wp plugin deactivate tourmaster
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block XSS payloads in URLs.
- Use Content Security Policy (CSP) headers to restrict script execution sources.
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Installed Plugins for tourmaster version below 5.3.5.Check Version:
wp plugin get tourmaster --field=versionVerify Fix Applied:
Confirm tourmaster plugin version is 5.3.5 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual URL parameters containing script tags or JavaScript in web server logs.
Network Indicators:
- HTTP requests with suspicious parameters containing script tags or JavaScript code.
SIEM Query:
source="web_server_logs" AND (url="*<script*" OR url="*javascript:*")