Live Helper Chat Stored Cross-Site Scripting Vulnerability in Personal Canned Messages

A stored cross-site scripting vulnerability has been identified in Live Helper Chat versions through 4.60. This vulnerability allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into Personal Canned Messages. When an admin or operator views the message and attempts to send canned responses, the injected script executes in their browser context.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the message.

Reproduction

To reproduce this vulnerability, log in as an operator and navigate to Personal Canned Messages. Create a new message and inject a script payload, such as an image tag with an 'onerror' event. After saving the message, attempt to use it, which will trigger the execution of the injected script.

Remediation

Users are advised to update Live Helper Chat to version 4.61 or later, where this vulnerability has been fixed.