exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

WordPress Organizer 1.2.1 XSS / CSRF / Shell Upload

WordPress Organizer 1.2.1 XSS / CSRF / Shell Upload
Posted Apr 25, 2012
Authored by MustLive

WordPress Organizer version 1.2.1 suffers from cross site request forgery, cross site scripting, and shell upload vulnerabilities.

tags | exploit, shell, vulnerability, xss, csrf
SHA-256 | 5d7da27b984ced3d8195b475c086f6fa632941aa13a56de1779eb08cce7b634d

WordPress Organizer 1.2.1 XSS / CSRF / Shell Upload

Change Mirror Download
Hello list!

I want to warn you about multiple security vulnerabilities in plugin
Organizer for WordPress. This is the second in series of advisories
concerning vulnerabilities in this plugin.

These are Cross-Site Scripting (reflected and persistent), Cross-Site
Request Forgery and Arbitrary File Upload (Code Execution) vulnerabilities.

-------------------------
Affected products:
-------------------------

Vulnerable are Organizer 1.2.1 and previous versions.

As answered me the developer of the plugin, he doesn't support it anymore
and will not be fixing any vulnerabilities in it.

----------
Details:
----------

XSS (WASC-08):

http://site/wp-admin/admin.php?page=organizer/page/users.php&edit_id=%3Cscript%3Ealert(document.cookie)%3C/script%3E

XSS (Persistent) (WASC-08):

Exploit:

http://websecurity.com.ua/uploads/2012/Organizer%20XSS-2.html

Code will execute at the page users.php of the plugin.

CSRF (WASC-09):

Via attack on function Add/Edit User Setting (which combined into the same
POST request) it's possible to add and edit settings.

POST request at page
http://site/wp-admin/admin.php?page=organizer/page/users.php. Similarly to
above exploit for XSS.

Via attack on function Delete User Setting it's possible to delete settings.

http://site/wp-admin/admin.php?page=organizer/page/users.php&delete_id=admin

Arbitrary File Upload (Code Execution) (WASC-31):

It's possible to upload arbitrary files with code execution (php files).
Because in field "File extensions allowed" it's possible to set extensions
of scripts, such as "php".

This will allow to upload to the server and execute arbitrary scripts.
Besides attacking admin via above-mentioned CSRF vulnerability for changing
of the settings (or getting access to admin account for this), the
Insufficient Authorization vulnerability (described in the third advisory)
also can be used for this (in the presence of account even with lowest
rights as Subscriber).

------------
Timeline:
------------

2012.04.15 - informed the developer about previous vulnerabilities.
2012.04.16 - announced at my site (http://websecurity.com.ua/5786/).
2012.04.17 - the developer answered, that he didn't support the plugin
anymore.
2012.04.17 - additionally informed the developer about new vulnerabilities.
2012.04.24 - disclosed at my site.

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua

Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close