# Title: CarSpot – Automotive Car Dealer Wordpress Classified Theme v2.1.5 Stored XSS Injection # Author: QUIXSS # Date: 2019-04-18 # Software: CarSpot – Automotive Car Dealer Wordpress Classified Theme v2.1.5 # Technical Details & Description: # Bad input field data filtering has been discovered in the «CarSpot – Automotive Car Dealer Wordpress Classified Theme». Current version of this Premium Theme is 2.1.5. # Demo Website: # https://themeforest.net/item/carspot-automotive-car-dealer-wordpress-classified-theme/20195539 # https://carspot.scriptsbundle.com/ # Login: zulacone@businessagent.email, Password: asdasd (or register a new account @ the demo website) # PoC [Stored XSS Injection]: # Authorize on the demo website for tests: https://carspot.scriptsbundle.com/, login is zulacone@businessagent.email and passowrd is asdasd. If this account will be deleted, simply create a new one, it's easy. # On the profile page there is one vulnerable input field w/o filering: «Phone Number». Fill in your payload, f.e. <script>alert('QUIXSS')</script> and save this changes. After that, on each page where data from your profile is loading you'll see saved payload in action.