Vulnerability · Published Sep 26, 2022 · Assigned by WPScan
CVE-2022-3024Simple Bitcoin Faucets <= 1.7.0 - Unauthorised AJAX Call to Stored XSS
Medium 5.4
In plain English
A medium-severity incorrect authorization in Bitcoin Satoshi Tools : Faucets, Visitor Rewarder, Satoshi Games, Referral Program from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).
Official description
The Simple Bitcoin Faucets WordPress plugin through 1.7.0 does not have any authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscribers to call it and add/delete/edit Bonds. Furthermore, due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Bitcoin Satoshi Tools : Faucets, Visitor Rewarder, Satoshi Games, Referral Program | 1.7.0 – through 1.7.0 |
Weakness: CWE-863, CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N