search

wpeventmanager / wp-event-manager

WP Event Manager is a lightweight, scalable and full-featured event management plugin for adding event listing functionality to your WordPress site. The shortcode lists all the events, it can work with any theme and is really easy to setup and customise.
https://wp-eventmanager.com
34 stars 50 forks source link

Secuirity issue with banner field #1586

Closed mistry-jignesh closed 9 months ago

mistry-jignesh commented 9 months ago

First, go to the backend. Click on the field editor section.

Banner

Launch Burp Suite to capture the network traffic. Click on "save changes" below the form. Burp Suite will intercept the outgoing POST request. Modify the value of the event[banner][type] parameter to onmouseover="alert(/XSS/) and then allow the request to proceed.

banner2

Now check that the field editor banner field type is changed to the Text type field Also, the frontend post and event page banner is removed. Only a label is available on the form.

Banner3

Banner4

ritakikani commented 9 months ago

@mistry-jignesh , this is not security issue, this is working fine, if there is no any type selected then will not get any template file of field so this will not show any field at front-back side in event form

mistry-jignesh commented 9 months ago

As per @ritakikani - This is not security issue, this is working fine, if there is no any type selected then will not get any template file of field so this will not show any field at front-back side in event form

So I closed the issue.