PoC for CVE-2023-2123# Update - 5/10/2023
The CVE-2023-2123 ID was reserved and the PoC was published in the WPScan website: https://wpscan.com/vulnerability/44448888-cd5d-482e-859e-123e442ce5c1
# Details
Title: Unauthenticated Reflected Cross-Site Scripting in WP Inventory Manager Plugin for WordPress CMS</br>
Date: 2023-04-15</br>
Author: Danilo Albuquerque</br>
Vendor Homepage: https://wordpress.org</br>
Software Link: https://wordpress.org/download</br>
Version: WordPress 6.2</br>
Plugin's Name and Version: WP Inventory Manager 2.1.0.12</br>
Tested on: Brave (Version 1.50.119 Chromium: 112.0.5615.121 (Official Version) 64 bits)</br>
# PoC for Reflected XSS vulnerability in WP Inventory Manager 2.1.0.12
1. Go to the page that has the inventory items;
2. Access the item that you want;
3. Fill the form in the "Reserve This Item" section of the page and click on "Reserve" button;
4. Once you have been redirected to the "Your reservation has been submited" page, add the **ENCODED** payload ```%3Cscript%3Ealert%281%29%3C%2Fscript%3E``` in the ```message``` parameter in the URL;
5. Press enter to do the request and voilá.
When you do all that and update the current page, it will bring you the alert pop-up with the message in it.
## Screenshots below
1. Go to the page that has the inventory items:</br>
2. Access the item that you want:</br>
3. Fill the form in the "Reserve This Item" section of the page and click on "Reserve" button:</br>
4. Once you have been redirected to the "Your reservation has been submited" page, add the **ENCODED** payload ```%3Cscript%3Ealert%281%29%3C%2Fscript%3E``` in the ```message``` parameter in the URL:</br>
5.The alert pop-up:
# Bonus
You can also add a **DOUBLE ENCODED** malicious payload, and the attacker will be able to bypass some security controls such as not accept quotes.
The payload I used: ```%253Cscript%253Ealert%2528%2522pwned%2520by%2520daniloalbuqrque%2522%2529%253C%252Fscript%253E```
Screenshot below:</br>
[4.0K] /data/pocs/340f2d8aab42e43d128c79edd8c2385bb9c506df
└── [2.6K] README.md
0 directories, 1 file