what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

WordPress GD bbPress Attachments 2.1 Cross Site Scripting

WordPress GD bbPress Attachments 2.1 Cross Site Scripting
Posted Jul 12, 2015
Authored by Tom Adams

WordPress GD bbPress Attachments plugin version 2.1 suffers from a cross site scripting vulnerability.

tags | exploit, xss
SHA-256 | 910aec15623881f8a6ea0df0172bf7e2424b9a95dcbe4b3d22a8a0a635673419

WordPress GD bbPress Attachments 2.1 Cross Site Scripting

Change Mirror Download
Details
================
Software: GD bbPress Attachments
Version: 2.1
Homepage: http://wordpress.org/plugins/gd-bbpress-attachments/
Advisory report: https://security.dxw.com/advisories/reflected-xss-in-gd-bbpress-attachments-allows-an-attacker-to-do-almost-anything-an-admin-can/
CVE: Awaiting assignment
CVSS: 5.8 (Medium; AV:N/AC:M/Au:N/C:P/I:P/A:N)

Description
================
Reflected XSS in GD bbPress Attachments allows an attacker to do almost anything an admin can

Vulnerability
================
This plugin outputs the value of $_GET[‘tab’] without escaping (see forms/panels.php lines 3 and 39). An attacker could easily construct an URL which performs virtually any action an admin is able to perform, including creating/deleting users/posts, injecting malicious HTML into user-facing pages, or editing PHP files (if that feature hasn’t been disabled).

Proof of concept
================
Visit the following URL in a browser with no reflected XSS protection (i.e. Firefox or older versions of IE):
http://localhost/wp-admin/edit.php?post_type=forum&page=gdbbpress_attachments&tab=%22%3E%3Cscript%3Ealert(1)%3C/script%3E

Mitigations
================
Upgrade to version 2.3 or later

Disclosure policy
================
dxw believes in responsible disclosure. Your attention is drawn to our disclosure policy: https://security.dxw.com/disclosure/

Please contact us on security@dxw.com to acknowledge this report if you received it via a third party (for example, plugins@wordpress.org) as they generally cannot communicate with us on your behalf.

This vulnerability will be published if we do not receive a response to this report with 14 days.

Timeline
================

2015-02-25: Discovered
2015-07-01: Reported to vendor via email form on https://www.dev4press.com/contact/
2015-07-01: Requested CVE
2015-07-01: Vendor responded
2015-07-04: Vendor confirmed fixed
2015-07-08: Published



Discovered by dxw:
================
Tom Adams
Please visit security.dxw.com for more information.




Login or Register to add favorites

File Archive:

February 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    11 Files
  • 2
    Feb 2nd
    9 Files
  • 3
    Feb 3rd
    5 Files
  • 4
    Feb 4th
    0 Files
  • 5
    Feb 5th
    0 Files
  • 6
    Feb 6th
    0 Files
  • 7
    Feb 7th
    0 Files
  • 8
    Feb 8th
    0 Files
  • 9
    Feb 9th
    0 Files
  • 10
    Feb 10th
    0 Files
  • 11
    Feb 11th
    0 Files
  • 12
    Feb 12th
    0 Files
  • 13
    Feb 13th
    0 Files
  • 14
    Feb 14th
    0 Files
  • 15
    Feb 15th
    0 Files
  • 16
    Feb 16th
    0 Files
  • 17
    Feb 17th
    0 Files
  • 18
    Feb 18th
    0 Files
  • 19
    Feb 19th
    0 Files
  • 20
    Feb 20th
    0 Files
  • 21
    Feb 21st
    0 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close