WordPress SupportEzzy Ticket System 1.2.5 Cross Site Scripting

2014.11.14
Risk: Low
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-79

# Exploit Title: SupportEzzy Ticket System - WordPress Plugin Stored XSS Vulnerability # Date: 12-10-2014 # Exploit Author: Halil Dalabasmaz # Version: v1.2.5 # Vendor Homepage: http://codecanyon.net/item/supportezzy-ticket-system-wordpress-plugin/8908617 # Software Test Link: http://demo.cssjockey.com/cjsupport/supportezzy/ # Tested on: Iceweasel and Chrome # Vulnerabilities Description: ===Stored XSS=== Register and login to system and then submit new ticket. "URL (optional)" input is not secure. You can run XSS payloads, use sample payload to test. Sample Payload for Stored XSS: http://example.com "><script>alert(document.cookie);</script> ===Solution=== Filter the input fields aganist to XSS attacks. ===============


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top