Traveler - Travel Booking WordPress Theme v2.7.1 Reflected & Stored XSS Injections

ru QUIXSS (RU) ru
Risk: Low
Local: No
Remote: Yes

[*] :: Title: Traveler - Travel Booking WordPress Theme v2.7.1 Reflected & Stored XSS Injections [*] :: Author: QUIXSS [*] :: Date: 2019-05-05 [*] :: Software: Traveler - Travel Booking WordPress Theme v2.7.1 [?] :: Technical Details & Description: # Weak security measures like bad input & textarea fields data filtering has been discovered in the «Traveler - Travel Booking WordPress Theme». Current version of this WordPress premium theme is 2.7.1. [?] :: Demo Website: # # Frontend #1: # Backend #1: # Frontend #2: # Backend #2: [!] :: Special Note: # 5.869 Sales # «Change Avatar» upload field works really strange. F.e., u can upload any .PHP file with extension .php.png and break profile page (Server will respond with Error #500). Another possible issue is Null Byte Injection in PHP, but on the demo website any access to uploaded file will be blocked by CloudFlare. # On the «Google Chrome» browser reflected XSS isn't work cause of built-in browser security measures, better use «Mozilla» or «Opera» instead. [!] :: For developers: # Disabling any data changes on a demo websites doesn't make your applications more secure. It's good for business and sales but you are simply double-crossing your clients. [+] :: PoC [Links]: # # # # #"><img src=x onerror=alert(`QUIXSS`)> # [+] :: PoC [Reflected XSS Injection]: # For Reflected XSS Injection use default WordPress search on the demo website[payload] # Sample payload #1: "><img src=x onerror=alert(document.cookie)> # Sample payload #2: <input type=text autofocus onfocus=alert(document.cookie)> [+] :: PoC [Stored XSS Injection]: # Go to the demo website and register a new account (there is no validation or activation process) and then log in to your account. Go to page next. All input fields except «Username» and «E-mail» can be used for Stored XSS Injections, for test u can use any payload started from "> just to «close» input field and </textarea> to «close» the text box. Save the data and your payload(s) will be successfully injected. # Same logic works for any other theme options: «Checkout» page with multiple vulnerable input fields, «Write Review» page etc. etc. # Sample payload #1: "><script>alert('QUIXSS')</script> # Sample payload #2: </textarea><img src="x" onerror="window.location.replace('');">


Vote for this issue:


Thanks for you vote!


Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2021,


Back to Top