Supsystic Popup < 1.10.19 - Prototype Pollution

2023-06-2300:00:00

drwtsn

supsystic popup

version 1.10.19

create pop-up

load on any page

prototype pollution exploit

0.001 Low

EPSS

Percentile

46.4%

JSON

The plugin has a prototype pollution vulnerability that could allow an attacker to inject arbitrary properties into Object.prototype.

1) Create a pop-up that is set to load on any page
2) Go to `http://example.com/?__proto__[poc]=polluted`
3) Open browser console 
4) Type `poc` and see `polluted` as the result.

0.001 Low

EPSS

Percentile

46.4%

JSON

Related for WPEX-ID:545007FC-3173-47B1-82C4-ED3FD1247B9C