Vulners
Lucene search
ClickDesk 4.3 Cross Site Scripting
| Reporter | Title | Published | Views | Family All 6 |
|---|---|---|---|---|
 | CVE-2014-9211 | 14 Jan 202013:54 | – | cve |
 | CVE-2014-9211 | 14 Jan 202013:54 | – | cvelist |
 | EUVD-2014-9036 | 7 Oct 202500:30 | – | euvd |
 | CVE-2014-9211 | 14 Jan 202014:15 | – | nvd |
 | Cross site scripting | 14 Jan 202014:15 | – | prion |
 | CVE-2014-9211 | 22 May 202506:37 | – | redhatcve |
`ClickDesk Multiple Persistent XSS
Details
========================================================================================
Product: ClickDesk a [ cross platform live chat and support plugin ]
Security-Risk: High
Remote-Exploit: yes
Vendor-URL: https://www.clickdesk.com/
Advisory-Status: NotPublished
Credits
========================================================================================
Discovered by: Owais Mehtab
Greets To: Mirza Burhan Baig, Muhammad Waqar, Muhammad Ali Baloch, Navaid Zafar Ansari
Affected Products:
========================================================================================
ClickDesk <=4.3
Tested on wordpress 3.8.1
Description
========================================================================================
"Live Chat Plugin"
More Details
========================================================================================
I have discsovered a persistent Cross site scripting (XSS) inside
ClickDesk,the vulnerability can be easily exploited and can be used to steal cookies,
perform phishing attacks and other various attacks compromising the security of a
user.
Proof of Concept
========================================================================================
1-Live Chat XSS
---------------
go to any website having ClickDesk Live Chat installed,
Click on the "Live Chat widget" and set the below vector in name field
"><img src=O onerror=prompt(document.cookie);>
Now click on initiate chat
Wollah.. here you go with your own Cookie!
2-Email XSS
-----------
go to any website having ClickDesk Live Chat installed,
Click on the "Live Chat widget", this time select the email option and set the below vector in message field
"><img src=O onerror=prompt(document.cookie);>
Now Click on submit
Wollah.. again here you go with your own Cookie!
Solution
========================================================================================
Edit the source code to ensure that input is properly sanitised.
--
Regards,
Owais Mehtab
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
04 Mar 2014 00:00Current
6.4Medium risk
Vulners AI Score6.4
EPSS0.00328