exploit the possibilities

WordPress Organizer 1.2.1 XSS / CSRF / Shell Upload

WordPress Organizer 1.2.1 XSS / CSRF / Shell Upload
Posted Apr 25, 2012
Authored by MustLive

WordPress Organizer version 1.2.1 suffers from cross site request forgery, cross site scripting, and shell upload vulnerabilities.

tags | exploit, shell, vulnerability, xss, csrf
MD5 | 1636787d421ecc86016d375344c31402

WordPress Organizer 1.2.1 XSS / CSRF / Shell Upload

Change Mirror Download
Hello list!

I want to warn you about multiple security vulnerabilities in plugin
Organizer for WordPress. This is the second in series of advisories
concerning vulnerabilities in this plugin.

These are Cross-Site Scripting (reflected and persistent), Cross-Site
Request Forgery and Arbitrary File Upload (Code Execution) vulnerabilities.

-------------------------
Affected products:
-------------------------

Vulnerable are Organizer 1.2.1 and previous versions.

As answered me the developer of the plugin, he doesn't support it anymore
and will not be fixing any vulnerabilities in it.

----------
Details:
----------

XSS (WASC-08):

http://site/wp-admin/admin.php?page=organizer/page/users.php&edit_id=%3Cscript%3Ealert(document.cookie)%3C/script%3E

XSS (Persistent) (WASC-08):

Exploit:

http://websecurity.com.ua/uploads/2012/Organizer%20XSS-2.html

Code will execute at the page users.php of the plugin.

CSRF (WASC-09):

Via attack on function Add/Edit User Setting (which combined into the same
POST request) it's possible to add and edit settings.

POST request at page
http://site/wp-admin/admin.php?page=organizer/page/users.php. Similarly to
above exploit for XSS.

Via attack on function Delete User Setting it's possible to delete settings.

http://site/wp-admin/admin.php?page=organizer/page/users.php&delete_id=admin

Arbitrary File Upload (Code Execution) (WASC-31):

It's possible to upload arbitrary files with code execution (php files).
Because in field "File extensions allowed" it's possible to set extensions
of scripts, such as "php".

This will allow to upload to the server and execute arbitrary scripts.
Besides attacking admin via above-mentioned CSRF vulnerability for changing
of the settings (or getting access to admin account for this), the
Insufficient Authorization vulnerability (described in the third advisory)
also can be used for this (in the presence of account even with lowest
rights as Subscriber).

------------
Timeline:
------------

2012.04.15 - informed the developer about previous vulnerabilities.
2012.04.16 - announced at my site (http://websecurity.com.ua/5786/).
2012.04.17 - the developer answered, that he didn't support the plugin
anymore.
2012.04.17 - additionally informed the developer about new vulnerabilities.
2012.04.24 - disclosed at my site.

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

August 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    10 Files
  • 2
    Aug 2nd
    8 Files
  • 3
    Aug 3rd
    2 Files
  • 4
    Aug 4th
    1 Files
  • 5
    Aug 5th
    15 Files
  • 6
    Aug 6th
    79 Files
  • 7
    Aug 7th
    16 Files
  • 8
    Aug 8th
    11 Files
  • 9
    Aug 9th
    10 Files
  • 10
    Aug 10th
    0 Files
  • 11
    Aug 11th
    6 Files
  • 12
    Aug 12th
    26 Files
  • 13
    Aug 13th
    15 Files
  • 14
    Aug 14th
    19 Files
  • 15
    Aug 15th
    52 Files
  • 16
    Aug 16th
    11 Files
  • 17
    Aug 17th
    1 Files
  • 18
    Aug 18th
    2 Files
  • 19
    Aug 19th
    18 Files
  • 20
    Aug 20th
    19 Files
  • 21
    Aug 21st
    17 Files
  • 22
    Aug 22nd
    9 Files
  • 23
    Aug 23rd
    3 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close