Classified Listing Pro < 2.0.20 - Reflected Cross-Site Scripting
Description
After creating an Ad, using Classified Listing Pro puglin, the Ad menu, categories, and subcategorieds become vulnerable to Reflected Cross-Site Scripting (XSS).
Proof of Concept (POC)
To reproduce the failure, it is necessary creating at least one category and one Ad
With that so, we can explore the vulnerability:
Atacker
Affected Versions
Classified Listing Pro < 2.0.20
References
Classification
Type: Cross-Site Scripting
OWASP TOP 10: A03:2021-Injection
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Researchers/Hackers
Geovanni Campos (GeoZIN), Islan Ferreira (LnZ)., Thiago Martins (Kirito), Jorge Buzeti (R3tr0), Leandro Inacio (Saitama), Lucas de Souza (Sinnat), Matheus Oliveira (Froyd), Filipe Baptistella (Baptistella), Leonardo Paiva (Megatron), Jose Thomaz (Pip3r), Joao Maciel (Yohan), Vinicius Pereira (Vini), Hudson Nowak (Nowak) and Guilherme Acerbi (Ghost).
