CVE-2022-3024 — Simple Bitcoin Faucets <= 1.7.0 - Unauthorised AJAX Call to Stored XSS

Description (CNA)

The Simple Bitcoin Faucets WordPress plugin through 1.7.0 does not have any authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscribers to call it and add/delete/edit Bonds. Furthermore, due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues

Affected (CNA)

Vendor / product	Versions
Unknown / Bitcoin Satoshi Tools : Faucets, Visitor Rewarder, Satoshi Games, Referral Program	affected 1.7.0 through 1.7.0

CWE

CWE-863, CWE-352

References

https://wpscan.com/vulnerability/7f43cb8e-0c1b-4528-8c5c-b81ab42778dc

ADP enrichment

CVE

No English description supplied.

https://wpscan.com/vulnerability/7f43cb8e-0c1b-4528-8c5c-b81ab42778dc

CISA-ADP

No English description supplied.

No references supplied.