Bit Assist < 1.1.9 – Admin+ Stored Cross-Site Scripting | CVE 2023-3667

Description

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Proof of Concept

1. In the plugin's settings, click on Add Channel and select a custom channel.
2. Custom Channel link.
3. Paste/type javascript code `javascript:alert(document.cookie);`
4. Click on Save/Update
5. Open the site and click on the link to see the XSS.

Other vulnerable fields include:

- Custom Iframe - iFrame URL: `javascript:alert(document.cookie);`
- Gmap - Google maps embed code: `<img src=x onerror=confirm(/XSS/)>`
- FAQ -  FAQ Title: `<img src=x onerror=confirm(/XSS/)>`
- Knowledge base - Knowledge Base title: `<img src=x onerror=confirm(/XSS/)>`