Details
Title: Authenticated Reflected Cross-Site Scripting in "Uploading SVG, WEBP and ICO files" Plugin for WordPress CMS
Date: 2023-08-10
Author: Danilo Albuquerque
Vendor Homepage: https://wordpress.org
Software Link: https://wordpress.org/download
Version: WordPress 6.3
Plugin's Name and Version: Uploading SVG, WEBP and ICO files 1.2.1
Tested on: Brave (Version 1.50.119 Chromium: 112.0.5615.121 (Official Version) 64 bits)
PoC for Reflected XSS vulnerability in Uploading SVG, WEBP and ICO files 1.2.1
- Install the plugin;
- Create a SVG file with the malicious payload within it;
- Go to the "Media" page and upload the SVG file; and then
- Access the file through URL.
When you do all that and update the current page, it will bring you the alert pop-up with the message in it.
Screenshots below
-
No plugin PoC:
-
When there is no plugin the SVG file uploading does not work:
-
The plugin's version in this day:
-
The plugin is now installed and activated:
-
Created the SVG file with the malicious payload within it:
-
SVG file's upload done:
-
Payload triggered when the file is loaded:
Bonus section: Stored XSS
-
Changed the content of the malicious file:
-
Got the POST request in my Collaborator oastify:
