CVE-2024-3986 – SportsPress – Stored XSS – POC

In the rapidly evolving digital landscape, WordPress remains a popular choice for website creation, offering a plethora of plugins to enhance functionality and user experience. However, the extensive use of these plugins also introduces significant security risks. One such risk has recently been identified in the SportsPress plugin, a widely-used tool designed for sports club management. This vulnerability, assigned CVE-2024-3986, allows for Stored Cross-Site Scripting (XSS) attacks, posing a serious threat to website security.

CVE	CVE-2024-3986
Plugin	SportPress < 2.7.22
Critical	Low
All Time	851 000
Active installations	10 000+
Publicly Published	July 15, 2024
Last Updated	July 15, 2024
Researcher	Artyom Krugov
OWASP TOP-10	A7: Cross-Site Scripting (XSS)
PoC	Yes
Exploit	No
Reference	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-3986/ https://wpscan.com/vulnerability/76c78f8e-e3da-47d9-9bf4-70e9dd125b82/
Plugin Security Certification by CleanTalk
Logo of the plugin

Timeline

April 1, 2024	Plugin testing and vulnerability detection in the SportsPress have been completed
April 1, 2024	I contacted the author of the plugin and provided a vulnerability PoC with a description and recommendations for fixing
July 15, 2024	Registered CVE-2024-3986

Discovery of the Vulnerability

During routine testing, a critical vulnerability was discovered in version 2.7.20 of the SportsPress plugin. This flaw, which affects users with Admin+ rights, enables attackers to inject malicious scripts into the plugin’s functionality. Specifically, the vulnerability was found in the Events panel, under the Venues tab. By entering a specially crafted XSS payload into the Address field, the malicious script is stored and later executed whenever an unsuspecting user interacts with the compromised content..

Understanding of Stored XSS attack’s

XSS is a prevalent security issue where attackers inject malicious scripts into web pages viewed by other users. In WordPress, this often occurs through unsanitized input fields that accept HTML or JavaScript code. Examples in the past have included malicious redirects, stealing cookies, or manipulating web page content. The impact of such vulnerabilities can be significant, ranging from data breaches to complete website compromise.

Exploiting the Stored XSS Vulnerability

For example, in the case of the SportsPress plugin, an attacker could inject the following payload into the Address field of the Venues tab:

POC:

1. Go to the Admin user
2. Click on the Events panel
3. Enter the Venues tab
4. In the Address field, enter the XSS payload As a result, the payload is processed and fulfills the payload. Stored XSS – allow attackers to inject malicious scripts into web pages, which are then launched when unsuspecting users interact with compromised content. This can lead to a number of devastating consequences, including account hijacking, data theft, and malware distribution.

XSS payload: <script>alert(1)</script> “><script>

</script><img src=x onerror=alert(document.domain)>

____

When an administrator views the post containing this shortcode, the embedded script executes, potentially leading to further exploitation, such as creating a new admin account or other malicious actions.

Recommendations for Improved Security

To mitigate risks associated with XSS and similar vulnerabilities, website administrators should:

1. Update Regularly: Keep all plugins and the WordPress core updated to the latest versions.
2. Sanitize Inputs: Ensure that all user inputs are sanitized to prevent malicious data from being saved.
3. Use Security Plugins: Implement security plugins that provide firewall, malware scanning, and enhanced authentication features.
4. Regular Audits: Conduct regular security audits to identify and fix vulnerabilities.
5. Educate Users: Train users with access to the WordPress backend on security best practices and the importance of using strong, unique passwords.

By taking proactive measures to address Stored XSS vulnerabilities like CVE-2024-3986, WordPress website owners can enhance their security posture and safeguard against potential exploitation. Stay vigilant, stay secure.

#WordPressSecurity #StoredXSS #WebsiteSafety #StayProtected

Use CleanTalk solutions to improve the security of your website

ARTYOM K.