seeing is believing

Xorbin Analog Flash Clock 1.0 For WordPress XSS

Xorbin Analog Flash Clock 1.0 For WordPress XSS
Posted Jun 30, 2013
Authored by Prakhar Prasad, Rafay Baloch

Xorbin Analog Flash Clock plugin version 1.0 for WordPress suffers from a flash-based cross site scripting vulnerability.

tags | exploit, xss
advisories | CVE-2013-4692
MD5 | 33e9475e6620739e77bd9d7370a4c82a

Xorbin Analog Flash Clock 1.0 For WordPress XSS

Change Mirror Download
====================================================================
Xorbin Analog Flash Clock 1.0 Plugin for Wordpress Flash-based XSS
====================================================================

Description: This plugin displays analog flash clock on your website. It's easy to use and it's highly customizable. You can add analog flash clock to your website as a widget and use as many clocks as you like on one page

Published: 30-06-2013
Version : 1.0
Severity : Low to Moderate
CVSS Score: 5
CVE: 2013-4692
Authors : Prakhar Prasad http://www.prakharprasad.com
Rafay Baloch http://www.rafayhackingarticles.net
Download : http://wordpress.org/plugins/xorbin-analog-flash-clock/
Vendor : XORBin http://www.xorbin.com/
Google Dork: inurl:xorbin-analog-flash-clock

Details:

The vulnerability exists in "xorAnalogClock.swf" file of this plugin, "widgetUrl" and "urlWindow" parameter is taken
from external input and is passed first into URLRequest() and then to navigateToURL() function.

Pseudocode: navigateToURL(new URLRequest(_root.widgetUrl), _root.urlWindow);


Proof-of-Concept:

http://domain.tld/wordpress/wp-content/plugins/xorbin-analog-flash-clock/media/xorAnalogClock.swf#?urlWindow=_self&widgetUrl=javascript:alert(1);

Clicking on clock will execute the Javascript payload.


Solution:

Similar method can be applied as described here - https://code.google.com/p/doctype-mirror/wiki/ArticleFlashSecurityGetURL

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

July 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    2 Files
  • 2
    Jul 2nd
    3 Files
  • 3
    Jul 3rd
    15 Files
  • 4
    Jul 4th
    4 Files
  • 5
    Jul 5th
    15 Files
  • 6
    Jul 6th
    15 Files
  • 7
    Jul 7th
    10 Files
  • 8
    Jul 8th
    2 Files
  • 9
    Jul 9th
    10 Files
  • 10
    Jul 10th
    15 Files
  • 11
    Jul 11th
    15 Files
  • 12
    Jul 12th
    19 Files
  • 13
    Jul 13th
    16 Files
  • 14
    Jul 14th
    15 Files
  • 15
    Jul 15th
    3 Files
  • 16
    Jul 16th
    2 Files
  • 17
    Jul 17th
    8 Files
  • 18
    Jul 18th
    11 Files
  • 19
    Jul 19th
    15 Files
  • 20
    Jul 20th
    15 Files
  • 21
    Jul 21st
    15 Files
  • 22
    Jul 22nd
    6 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close