CVE-2024-29832

The current_url parameter of the AJAX call to the GalleryBox action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the current_url parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. No authentication is required to exploit this issue. Note that other parameters within a AJAX call, such as image_id, must be valid for this vulnerability to be successfully exploited.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://appcheck-ng.com/xss-vulnerabilities-discovered-10web-photogallery-wordpress-plugin/	Exploit Third Party Advisory
https://wordpress.org/plugins/photo-gallery/#developers	Product
https://appcheck-ng.com/xss-vulnerabilities-discovered-10web-photogallery-wordpress-plugin/	Exploit Third Party Advisory
https://wordpress.org/plugins/photo-gallery/#developers	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:10web:photo_gallery:*:*:*:*:*:wordpress:*:*

History

09 Apr 2025, 15:41

Type	Values Removed	Values Added
References	~~() https://appcheck-ng.com/xss-vulnerabilities-discovered-10web-photogallery-wordpress-plugin/ -~~	() https://appcheck-ng.com/xss-vulnerabilities-discovered-10web-photogallery-wordpress-plugin/ - Exploit, Third Party Advisory
References	~~() https://wordpress.org/plugins/photo-gallery/#developers -~~	() https://wordpress.org/plugins/photo-gallery/#developers - Product
CPE		cpe:2.3:a:10web:photo_gallery::::::wordpress::*
First Time		10web 10web photo Gallery

Information

Published : 2024-03-26 16:15

Updated : 2025-04-09 15:41

NVD link : CVE-2024-29832

Mitre link : CVE-2024-29832

CVE.ORG link : CVE-2024-29832

JSON object : View

Products Affected

10web

photo_gallery

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2024-29832", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "info@appcheck-ng.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2024-03-26T16:15:12.890", "references": [{"url": "https://appcheck-ng.com/xss-vulnerabilities-discovered-10web-photogallery-wordpress-plugin/", "tags": ["Exploit", "Third Party Advisory"], "source": "info@appcheck-ng.com"}, {"url": "https://wordpress.org/plugins/photo-gallery/#developers", "tags": ["Product"], "source": "info@appcheck-ng.com"}, {"url": "https://appcheck-ng.com/xss-vulnerabilities-discovered-10web-photogallery-wordpress-plugin/", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://wordpress.org/plugins/photo-gallery/#developers", "tags": ["Product"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "info@appcheck-ng.com", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "The current_url parameter of the AJAX call to the GalleryBox action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the current_url parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. No authentication is required to exploit this issue.\nNote that other parameters within a AJAX call, such as image_id, must be valid for this vulnerability to be successfully exploited."}, {"lang": "es", "value": "El par\u00e1metro current_url de la llamada AJAX a la acci\u00f3n GalleryBox de admin-ajax.php es vulnerable al Cross Site Scripting reflejado. El valor del par\u00e1metro current_url est\u00e1 incrustado dentro de un JavaScript existente dentro de la respuesta, lo que permite insertar y ejecutar JavaScript arbitrario. No se requiere autenticaci\u00f3n para aprovechar este problema. Tenga en cuenta que otros par\u00e1metros dentro de una llamada AJAX, como image_id, deben ser v\u00e1lidos para que esta vulnerabilidad se aproveche con \u00e9xito."}], "lastModified": "2025-04-09T15:41:45.343", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:10web:photo_gallery:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "58CE3C46-F773-4577-8A00-83AB7A8442C6", "versionEndExcluding": "1.8.22"}], "operator": "OR"}]}], "sourceIdentifier": "info@appcheck-ng.com"}