WordPress Advanced Ticket System < 1.0.64 - Authenticated Stored Cross-Site Scripting (XSS)

2021-08-1600:00:00

Tri Wanda Septian

373

wordpress

advanced ticket system

authenticated

stored cross-site scripting

injection

burp suite

permalink page

EPSS

0.001

Percentile

24.8%

JSON

The plugin does not sanitize or escape form values before saving to the database or when outputting, which allows high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Navigate to Tickets > Add New >  add all information on the title, post, Ticket type, Ticket priority, Ticket status > click update and intercept the request using burp suite. 
The parameters "wats_select_ticket_type", "wats_select_ticket_priority", "wats_select_ticket_status" can be injected with cross-site scripting (XSS), such as test"><script>alert('test')</script>; test"><script>alert(document.cookie)</script> payload. Next Click Forward on burp suite.

To trigger the XSS payload, Open the permalink post/ticket page.

EPSS

0.001

Percentile

24.8%

JSON

Related for WPEX-ID:41D9027C-A982-44C7-889E-721333496B5C