Live Helper Chat Stored Cross-Site Scripting Vulnerability in Chat Transfer Function

A stored cross-site scripting vulnerability has been identified in Live Helper Chat versions through 4.60. This vulnerability allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the operator name parameter. The issue arises in the chat transfer function, where the injected script is executed in the context of the receiving operator's chat interface.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user receiving the chat transfer.

Reproduction

To reproduce this vulnerability, log in as an operator and navigate to the operator settings page. In the 'Name' field, inject a script payload, such as an image tag with an 'onerror' event. After saving the changes, initiate a chat with a visitor and transfer the chat to another operator. The injected script will execute in the receiving operator's chat interface.

Remediation

Users can update to Live Helper Chat version 4.61 or later, where this vulnerability has been fixed.