all things security

Quick Paypal Payments Cross Site Scripting

Quick Paypal Payments Cross Site Scripting
Posted Oct 18, 2013
Authored by Zy0d0x | Site nullsecurity.net

Quick Paypal Payments, the plugin from quick-plugins.com, suffers from a persistent cross site scripting vulnerability.

tags | exploit, xss
MD5 | 45a892c6ff55acd5d90d805df8701518

Quick Paypal Payments Cross Site Scripting

Change Mirror Download
TITLE
=====

Quick Paypal Payments - Persistent Cross Site Scripting Vulnerability


AUTHOR
======

Zy0d0x


BLOG
====

https://zy0d0x.com

DATE
====

10/08/2013

VENDOR
======

Quick Plugins - http://quick-plugins.com/


AFFECTED PRODUCT
================

Quick Paypal Payments Wordpress Plugin Version 3.0 possibly earlier


VULNERABILITY CLASS
===================

Cross-Site Scripting


DESCRIPTION
===========


Quick Paypal Payments suffers from a persistent Cross-Site Scripting vulnerability due to a lack
of input validation and output sanitization of the "reference" and "amount" paramaters.
Other input fields are also effective to reflective cross site scripting.


PROOF OF CONCEPT
================

Enter the following into the field where Quick Paypal Payments requests a Payment reference.

--- SNIP ---

"><script>alert(String.fromCharCode(90,121,48,100,48,120))</script><

--- SNIP ---

If the message has been sent successfully a alert diolog will apear containing Zy0d0x when an user checks there message in the dashboard.


IMPACT
======

An attacker could potentially hijack session authentication tokes of remote users and leverage the
vulnerability to increase the attack vector to the underlying software and operating system of the victim.


THREAT LEVEL
============

High


STATUS
======

Not Fixed


Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

July 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    2 Files
  • 2
    Jul 2nd
    3 Files
  • 3
    Jul 3rd
    15 Files
  • 4
    Jul 4th
    4 Files
  • 5
    Jul 5th
    15 Files
  • 6
    Jul 6th
    15 Files
  • 7
    Jul 7th
    10 Files
  • 8
    Jul 8th
    2 Files
  • 9
    Jul 9th
    10 Files
  • 10
    Jul 10th
    15 Files
  • 11
    Jul 11th
    15 Files
  • 12
    Jul 12th
    19 Files
  • 13
    Jul 13th
    16 Files
  • 14
    Jul 14th
    15 Files
  • 15
    Jul 15th
    3 Files
  • 16
    Jul 16th
    2 Files
  • 17
    Jul 17th
    8 Files
  • 18
    Jul 18th
    11 Files
  • 19
    Jul 19th
    15 Files
  • 20
    Jul 20th
    15 Files
  • 21
    Jul 21st
    15 Files
  • 22
    Jul 22nd
    7 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close