A stored cross site scripting web vulnerability has been discovered in the official WordPress Contentive Theme web-application.The non-persistent vulnerability allows remote attackers to inject own malicious script code to client-side application to browser requests. The client-side cross site vulnerability is located in the `label` value of the page module GET method request. Remote attackers are able to inject own malicious script codes to the client-side of the online service web-application to compromise user session information or data.
The security risk of the cross site web vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 3.2.
Exploitation of the cross site vulnerability requires no privileged web-application user account and low user interaction.
Successful exploitation results in session hijacking, persistent phishings attacks, persistent external redirect and malware loads or persistent
manipulation of affected and connected module context.
[+] Contentive Theme (WordPress)
Product & Service Introduction:
Contentive is a global B2B media and information company, helping professionals and businesses excel in a digital world. We provide an engaging mix of news, events, intelligence and training, across Digital Marketing, Digital Finance and other Business Media verticals.
(Copy of the Vendor Homepage: https://www.contentive.com/)
Date of Discovery:
Solution – Fix & Patch:
The vulnerability can be patched by a parse and encode of the vulnerable `label` value in the webpage GET method request. Encode the parameter and restrict the value input to prevent further script code injection attacks.
Proof of Concept (PoC):
The remote cross site vulnerability can be exploited by remote attackers privileged web-application user accounts with low user interaction. For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.
PoC: Example http://wp.localhost:8080/?s=[CLIENT SIDE CROSS SITE SCRIPTING VULNERABILITY!] PoC: Exploitation http://wp.localhost:8080/?s="'/><svg/onload=alert(/31337/);> PoC: Vulnerable Source <form role="search" method="get" id="searchform" action="http://wp.localhost:8080"> <div> <input type="text" value=""'/><svg/onload=alert(123);>" name="s" id="s"/> <input type="submit" id="searchsubmit" value=""/> </div> </form>