WordPress AVChat Video Chat 1.4.1 - Cross-Site Scripting

What is "WordPress AVChat Video Chat 1.4.1 - Cross-Site Scripting?"

The "WordPress AVChat Video Chat 1.4.1 - Cross-Site Scripting" module is designed to detect a vulnerability in the AVChat Video Chat plugin for WordPress. This vulnerability allows for reflected cross-site scripting (XSS) attacks through the index_popup.php file and multiple parameters. The severity of this vulnerability is classified as medium, with a CVSS score of 5.4.

The original author of this module is DhiyaneshDK.

Impact

If exploited, this vulnerability could allow an attacker to inject malicious scripts into the affected website, potentially leading to unauthorized access, data theft, or other malicious activities.

How the module works?

The module works by sending a specific HTTP request to the target website and then analyzing the response to determine if the vulnerability is present. The request template used by the module is as follows:

GET /wp-content/plugins/avchat-3/index_popup.php?movie_param=</script><script>alert(document.domain)</script>&FB_appId=FB_appId%22><script>alert(document.domain)</script>& HTTP/1.1
Host: [target website]

The module then applies the following matching conditions to the response:

- The response body must contain the following string: value="FB_appId"><script>alert(document.domain)</script>" - The response headers must contain the string text/html - The HTTP status code must be 200

If all of these conditions are met, the module will report the vulnerability.

For more information, you can refer to the Codevigila website.