# Stored XSS in drive.uber.com WordPress admin panel

Malformed request to All In One Event Calendar plugin on drive.uber.com stored unescaped error details in WordPress admin dashboard, yielding stored XSS against administrators.

- Payout: $2,000
- Severity: high
- Program: Uber
- Credited: jouko
- Disclosed: 2016-05-14
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/126099
- Library page: https://bugbountylibrary.com/r/h1%3A126099
- Tags: domain:web impact:ato impact:privesc kind:bounty platform:hackerone sev:high tech:php tech:wordpress technique:source-review vuln:xss

**Target:** WordPress admin dashboard via All In One Event Calendar plugin on drive.uber.com
**Root cause:** Plugin's exception handler builds an admin dashboard error banner from attacker-controllable request data (the triggering URL) without HTML-encoding, so injected markup persists and executes for administrators.
**Steps:**
1. Send a raw HTTP request to `/oh/?ai1ec_js_widget=ai1ec_agenda_widget&render=true&events_per_page=$%&xss=<svg/onload=alert(/stored-xss/.source)>` without URL-encoding special chars (use openssl s_client/PERL, not a browser)
2. Malformed `events_per_page` triggers an invalid SQL format-string error in the plugin
3. Plugin disables itself and stores an error banner containing the unescaped request URL
4. Administrator logs into WordPress Dashboard and the stored `<svg/onload>` executes under admin privileges
**How found:** Researcher was probing the All In One Event Calendar plugin (prior known target) and noticed error conditions render attacker-controllable URL data into the admin Dashboard banner; tested locally on WordPress+plugin to confirm the unescaped reflection.
**Exploitation:** Attacker sends one malformed unencoded request; the plugin's error banner persists the payload in the admin Dashboard. When any administrator loads the Dashboard, the script runs with admin privileges and can issue AJAX calls to create a new admin user or write PHP via plugin/theme editors, achieving server-side compromise.
**Escalation:** Stored XSS in admin context escalates to full site takeover via AJAX admin-user creation or PHP code injection through plugin/theme editors.
**Insight:** Error/exception banners that echo the triggering request URL are a reliable stored-XSS sink in admin panels; trigger plugin error states with malformed params (e.g. bad format strings) and check whether the URL is HTML-encoded in the persisted notice.