CVE-2020-36931: Click2Magic Stored XSS Vulnerability

CVE-2020-36931 Overview

CVE-2020-36931 is a stored cross-site scripting (XSS) vulnerability in Click2Magic version 1.1.5, a customer support and live chat application. The vulnerability exists in the chat name input field, where attackers can inject malicious scripts that persist in the application. When administrators process user requests containing these malicious payloads, the injected scripts execute in the admin's browser context, potentially allowing attackers to steal session cookies and sensitive authentication data.

Critical Impact

Attackers can capture administrator cookies and session tokens by crafting malicious payloads in chat name fields, potentially leading to account takeover of administrative accounts.

Affected Products

• Click2Magic version 1.1.5
• Click2Magic live chat application
• Click2Magic customer support platform

Discovery Timeline

• 2026-01-25 - CVE CVE-2020-36931 published to NVD
• 2026-01-26 - Last updated in NVD database

Technical Details for CVE-2020-36931

Vulnerability Analysis

This stored cross-site scripting vulnerability stems from insufficient input validation and output encoding in the Click2Magic chat application. The application fails to properly sanitize user-supplied input in the chat name field before storing it in the database and subsequently rendering it in administrative interfaces.

The stored nature of this XSS vulnerability makes it particularly dangerous. Unlike reflected XSS where an attacker must trick a victim into clicking a malicious link, stored XSS payloads persist on the server. Every time an administrator accesses the dashboard to review or process user chat requests, the malicious script executes automatically. This creates a reliable attack vector for session hijacking and credential theft.

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), which encompasses various forms of cross-site scripting attacks.

Root Cause

The root cause of CVE-2020-36931 is improper input validation and insufficient output encoding in the Click2Magic application. When a user initiates a chat session and provides their name, the application stores this value directly without sanitizing potentially dangerous characters or scripts. When administrators view the chat request, the unsanitized name field is rendered directly into the HTML page without proper encoding, allowing injected JavaScript code to execute in the administrator's browser context.

Attack Vector

The attack is executed over the network, requiring the attacker to have a low level of access to initiate a chat session. The attack flow involves the following steps:

1. An attacker accesses the Click2Magic chat widget on a target website
2. When prompted for a name, the attacker enters a malicious JavaScript payload instead of a legitimate name
3. The payload is stored in the application database
4. When an administrator reviews or processes the chat request, the malicious script executes in their browser
5. The script can exfiltrate cookies, session tokens, or perform actions on behalf of the administrator

A public exploit is available on Exploit-DB #49347, which demonstrates the technique for injecting JavaScript payloads through the chat name field to capture administrator session data.

Detection Methods for CVE-2020-36931

Indicators of Compromise

• Unusual JavaScript code or HTML entities appearing in chat name fields in the database
• Script tags, event handlers (e.g., onerror, onload), or encoded payloads in user-submitted chat names
• Outbound connections from administrator browsers to unexpected external domains
• Administrator session cookies being used from unexpected IP addresses or geographic locations

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block common XSS payloads in input fields
• Monitor server logs for requests containing suspicious JavaScript patterns or encoded script elements
• Deploy browser-based XSS detection tools that can identify malicious script execution in administrative interfaces
• Utilize SentinelOne's Singularity platform to monitor endpoint behavior for signs of session hijacking or credential theft attempts

Monitoring Recommendations

• Enable comprehensive logging for all user input fields in the Click2Magic application
• Configure alerts for administrator accounts being accessed from new locations or devices
• Monitor for unusual administrative actions that could indicate compromised sessions
• Implement Content Security Policy (CSP) headers and monitor for policy violations that may indicate XSS attempts

How to Mitigate CVE-2020-36931

Immediate Actions Required

• Upgrade Click2Magic to the latest available version that addresses this vulnerability
• Review existing chat records for potentially malicious payloads in name fields
• Reset administrator session tokens and credentials as a precautionary measure
• Implement additional input validation on chat name fields as a defense-in-depth measure
• Enable Content Security Policy (CSP) headers to restrict script execution sources

Patch Information

Organizations using Click2Magic version 1.1.5 should check the Click2Magic Homepage for security updates and patched versions. The VulnCheck Advisory on ClickMagic provides additional context on addressing this vulnerability. Until an official patch is available, organizations should implement the workarounds described below.

Workarounds

• Implement server-side input validation to strip or encode special characters from the chat name field
• Deploy a Web Application Firewall (WAF) with rules to detect and block XSS payloads
• Configure Content Security Policy (CSP) headers with strict script-src directives to prevent inline script execution
• Consider using HTTP-only and Secure flags on session cookies to mitigate cookie theft even if XSS occurs
• Restrict administrative access to the Click2Magic interface to trusted networks or VPN connections

# Example Content Security Policy header configuration for Apache
# Add to .htaccess or Apache configuration
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; frame-ancestors 'self';"