Description

Livehelperchat is vulnerable to stored cross site scripting.

Proof of Concept

1 . Login to the demo account

2 . Go to settings –> Live help configuration –>Visual settings for the visitor –> widget theme –>new –> name field

3 . Add payload in name field and click save

4 . Go to setting –>embed code –> questionary embed code –> click page embed code alert will trigger.

payload {{constructor.constructor(‘alert(1)’)()}}

Impact

This vulnerability is capable of stolen the user cookie