Premium Support Tickets For WHMCS 1.2.10 Cross Site Scripting

`Exploit Title: Premium Support Tickets For WHMCS Reflected XSS  
Exploit Author: Sajibe Kanti  
Vendor: ModulesGarden  
Vendor Homepage:  
https://www.modulesgarden.com/products/whmcs/premium-support-tickets  
Product Name: Premium Support Tickets For WHMCS  
Product Version: v1.2.10  
Tested Version: WHMCS 8.10.1  
Tested on: Windows 10  
Vulnerabilities Discovered Date: 29/04/2024  
  
Description:  
The Premium Support Tickets For WHMCS plugin by ModulesGarden is vulnerable  
to a reflected cross-site scripting (XSS) attack. This vulnerability allows  
an attacker to inject malicious JavaScript code into the "error&msg="  
parameter of the submitticket.php page, leading to the execution of  
arbitrary code in the context of the victim's browser.  
  
  
Proof of Concept (POC):  
1. Identify a website that utilizes the Premium Support Tickets For WHMCS  
plugin by ModulesGarden.  
2. Navigate to the ticket submission page (submitticket.php).  
3. Select any department to open a new ticket.  
4. If you lack support credit points, you will receive an error message  
with the parameter "error&msg=clientarea_message_cantcreateinthisdept".  
5. Inject your payload into the "error&msg=" parameter.  
6. Construct the following URL with your payload:  
  
https://example.com/submitticket.php?PremiumSupportTickets=error&msg=%22/%3E%3CsvG%20onLoad=alert(/xss/)%3E  
7. Replace the payload with your desired XSS payload:  
"<svg/onLoad=alert(/OPENBUGBOUNTY/)>"  
8. Visit the modified URL in your browser.  
9. Observe the XSS popup indicating successful exploitation of the  
vulnerability.  
  
  
Impact:  
Successful exploitation of this vulnerability could allow an attacker to  
execute arbitrary JavaScript code in the context of an authenticated user's  
browser session. This could lead to various attacks, including but not  
limited to:  
  
- Theft of sensitive information (session cookies, credentials, etc.)  
- Phishing attacks targeting users of the affected WHMCS instance  
- Defacement of the website or redirection to malicious content  
- Browser-based attacks such as keylogging or screen capturing  
  
Note: This exploit is for educational purposes only. Unauthorized access to  
or modification of systems is illegal and unethical. Always obtain proper  
authorization before testing or exploiting vulnerabilities.  
`